← Back

CVE-2026-25707

nvd nist
Published: Jun 29, 2026Modified: Jun 30, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: meissner@suse.de (Secondary)

Description

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

Affected (1)

Products: Opensuse: Libzypp
Opensuse
1 product
Libzypp
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Libzypp
Before 17.38.10

Related CWEs

CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (2)

Source: meissner@suse.de
Issue Tracking
Source: meissner@suse.de
Patch

Timeline

No history available yet.