This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-25707 →

DEBIAN-CVE-2026-25707

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repos...

Original description

The description as published by the source.

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libzypp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libzypp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 libzypp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.38.11-1"}]}]

References

advisory security-tracker.debian.org