CVE-2026-25707: A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories…

PriorityP348high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.60%

45.1th percentile

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
opensuse	libzypp	< 17.38.10	17.38.10
suse	libzypp	< 17.38.10	17.38.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.