Executive brief
libzypp is a core library used by Linux systems (like openSUSE and SUSE Linux Enterprise) to manage software updates and repositories. A vulnerability in how it handles repository configuration files allows an attacker to trick the system into writing data to unintended locations on the hard drive. This could be used to fill up disk space in critical system directories, potentially causing the system to crash or stop functioning correctly.
Technical details
A path traversal vulnerability (CWE-24) exists in libzypp when processing the 'path' component of .repo files. By providing a specially crafted repository configuration file from a remote server, an attacker can inject path traversal sequences to redirect zypp cached data into arbitrary system directories. This requires the attacker to have the ability to provide or influence the repository source (low privileges required). The primary impact is on system availability, as an attacker can fill critical partitions with data. The issue is fixed in libzypp versions 17.38.13 and 16.22.19.
Affected products
- SUSE libzypp 17.x < 17.38.13, < 16.22.19
Timeline
- 2026-06-08: disclosed: Reported by Michael Andres to SUSE Bugzilla
- 2026-06-08: patched: Fixes identified for Code12 and Code15/16/Factory
- 2026-06-09: advisory: SUSE security advisories published
- 2026-06-18: advisory: NVD publication date