Cyber Resilience

CVE-2026-25707

High

Published: 29 June 2026

Published
29 June 2026
Modified
30 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0060 44.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-25707 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Opensuse Libzypp. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

CWE(s)
CWE-23

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Path traversal enables arbitrary file overwrite by remote repo metadata, directly facilitating privilege escalation as stated in the CVE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-41046Shared CWE-23
CVE-2025-62878Shared CWE-23
CVE-2026-8100Shared CWE-23
CVE-2020-8031Same vendor: Opensuse
CVE-2022-21949Same vendor: Opensuse
CVE-2024-49505Same vendor: Opensuse
CVE-2026-32725Shared CWE-23
CVE-2022-21948Same vendor: Opensuse
CVE-2023-22652Same vendor: Opensuse
CVE-2021-44568Same vendor: Opensuse

Affected Assets

opensuse
libzypp
≤ 17.38.10

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References