A relative path traversal flaw (CWE-23) exists in libzypp in the handling of keyhint elements in repomd.xml. When a repository provides a keyhint that resolves to a path outside its expected directory, libzypp, running with root privileges during package operations, can write or overwrite any file on the host. An attacker who can supply a malicious repomd.xml can therefore inject or modify files as root, potentially installing malware or altering system configuration.

SUSE libzypp installations older than version 17.38.12 are affected. Any system that uses libzypp for package and repository management and that downloads data from a repository that can be controlled by an attacker is at risk.

The CVSS score of 8.4 indicates a high severity issue, while the EPSS score of <1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to host a malicious repository; once the system processes that repository, the path traversal is exercised and root-level writes are performed, leading to full compromise of the affected system.