CVE Intelligence

SUSE Libzypp vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting SUSE Libzypp: 2 record(s), with affected versions and fixes.

CVE-2026-25707 High · 8.8 CWE-23 Jun 29, 2026
Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.
CVE-2026-44942 Medium · 6.5 CWE-24 Jun 18, 2026
libzypp .repo files can have an optional path which can lead to path traversal attacks
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.