libzypp vulnerabilities
3 known CVE vulnerabilities in libzypp, translated and rated.
- CVE-2026-44941High
A relative path traversal vulnerability in the "keyhint" option of repomd.xml parsing in libzypp before 17.38.12 allows attackers to supply a malicious repository to inject or overwrite files on the target system as root.
- CVE-2026-25707High
A relative path traversal vulnerability in libzypp before 17.38.10 allows remote attackers to overwrite system files by processing malicious repository metadata. This can lead to denial of service or privilege escalation.
- CVE-2026-44942Medium
A path traversal vulnerability in handling the 'path' component of .repo files in libzypp before version 17.38.13 in the 17.x series, or before 16.22.19, could allow attackers to fill directories on the system outside of the zypp cache with content.