CVE-2026-25707: Opensuse Libzypp

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

Affected products

• Opensuse Libzypp: before 17.38.10 (fixed in 17.38.10)

Published 2026-06-29. Last modified 2026-06-30.