The vulnerability arises when the PluginScript in libzypp attempts to chroot the plugin environment to the value of repoManagerRoot. When this target is the system root '/'—which is common in default configurations or when the --root flag is used—the chroot operation becomes a no‑op. This allows an attacker to traverse the file system and execute arbitrary host binaries such as /bin/bash with root privileges, effectively enabling remote code execution and privilege escalation.

SUSE Linux Enterprise and openSUSE systems that use libzypp. No specific version details are provided in the CNA data; administrators should ensure any distribution using libzypp is assessed for this issue.

The CVSS score of 8.5 indicates high severity. Because no EPSS score is available, the current exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, involving the ability to load or influence plugin scripts that run under libzypp; however, the formal data does not specify whether remote trigger is possible, so the assessment assumes local privilege escalation potential.