CVE-2026-25707 Overview
CVE-2026-25707 is a relative path traversal vulnerability in libzypp before version 17.38.10. The flaw exists in how the library processes repository metadata, allowing remote attackers who supply malicious repositories to overwrite arbitrary files on the target system. Successful exploitation can lead to denial of service or privilege escalation on affected openSUSE and SUSE Linux systems. The vulnerability is tracked as [CWE-23: Relative Path Traversal].
Critical Impact
A remote attacker controlling a repository can traverse outside the intended directory when metadata is fetched, overwriting sensitive files and potentially escalating to root privileges via the package management subsystem.
Affected Products
- openSUSE libzypp versions prior to 17.38.10
- SUSE Linux Enterprise distributions bundling vulnerable libzypp
- openSUSE Leap and Tumbleweed installations relying on zypper package management
Discovery Timeline
- 2026-06-29 - CVE-2026-25707 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-25707
Vulnerability Analysis
The vulnerability resides in libzypp, the package management library underpinning zypper and YaST on SUSE-family distributions. When libzypp parses repository metadata files such as repomd.xml and SUSE tags content files, it accepts location entries pointing to file paths without adequately validating that those paths remain within the repository root.
An attacker who convinces a user or system to add a malicious repository, or who compromises an existing repository mirror, can craft metadata entries containing relative path components. During refresh or install operations, libzypp writes downloaded files to the traversed paths. Because package management runs with elevated privileges, this write primitive extends to system-critical locations.
Root Cause
The root cause is missing sanitization of file location strings within the repository metadata parsers, specifically in ContentFileReader.cc and RepomdFileReader.cc. Entries referring to locations outside the repository directory were not filtered before use.
Attack Vector
Exploitation requires user interaction, typically adding or refreshing a repository controlled by the attacker. Once trusted, the crafted metadata is fetched over the network and processed locally, giving the attacker file-overwrite capability with the privileges of the invoking package manager operation.
// Patch excerpt: zypp/zypp/parser/yum/RepomdFileReader.cc
#include <iostream>
#include <utility>
+#include <zypp/ZYppCallbacks.h>
#include <zypp-core/base/String.h>
-#include <zypp-core/base/Logger.h>
+#include <zypp-core/base/LogTools.h>
#include <zypp-core/base/Regex.h>
#include <zypp-core/Pathname.h>
// Source: https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b
The patch introduces callback infrastructure and additional logging utilities used by new logic that discards metadata entries whose resolved location falls outside the repository directory.
Detection Methods for CVE-2026-25707
Indicators of Compromise
- Unexpected files appearing outside standard package cache paths such as /var/cache/zypp/ following a zypper refresh or zypper install operation.
- Repository metadata files containing location href attributes with ../ sequences or absolute paths.
- Modifications to system binaries or configuration files with timestamps aligned to recent repository refresh events.
Detection Strategies
- Inspect repomd.xml and SUSE tags content files from third-party repositories for href values containing parent-directory references.
- Audit /etc/zypp/repos.d/ for recently added or modified .repo files pointing to untrusted mirrors.
- Correlate zypper history logs in /var/log/zypp/history with unexpected file modifications on the filesystem.
Monitoring Recommendations
- Enable file integrity monitoring on system directories such as /etc, /usr/bin, and /usr/lib to identify writes originating from package management processes.
- Log and alert on zypper invocations that add new repositories, especially from HTTP or user-supplied URLs.
- Track outbound repository fetches to non-corporate mirrors from managed Linux hosts.
How to Mitigate CVE-2026-25707
Immediate Actions Required
- Upgrade libzypp to version 17.38.10 or later on all openSUSE and SUSE Linux Enterprise systems.
- Remove any repositories from /etc/zypp/repos.d/ that were sourced from untrusted or unverified providers.
- Verify GPG signature enforcement is enabled for all configured repositories.
Patch Information
The fix is available in the openSUSE libzypp commit f09feda7, which modifies ContentFileReader.cc and RepomdFileReader.cc to discard metadata entries referring to locations outside the repository. Distribution-specific updates are tracked in SUSE Bug Report #1259802.
Workarounds
- Restrict repository configuration to trusted, signed sources only, and disable auto-refresh for untrusted repositories.
- Require administrator review before adding any new repository via zypper addrepo.
- Isolate package management operations to controlled maintenance windows with change monitoring in place.
# Verify installed libzypp version and enforce GPG checks
rpm -q libzypp
zypper lr -d | grep -E 'GPG|Enabled|URI'
# Disable an untrusted repository until libzypp is patched
sudo zypper modifyrepo --disable <repo-alias>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
