A relative path traversal flaw (CWE‑23) is present in libzypp’s handling of the keyhint element in repomd.xml. When a malicious repository supplies a keyhint that resolves to a path outside the repository directory, libzypp, running with root privileges during package operations, writes or overwrites any file on the host. The vulnerability allows an attacker who can supply a crafted repomd.xml to directly create or modify files with root ownership.

SUSE libzypp installations older than version 17.38.12 are affected. Any system that uses libzypp for package and repository management and that downloads data from a repository that can be controlled by an attacker is at risk.

The CVSS score of 8.4 indicates a high severity issue, while the EPSS score of <1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires the attacker to host a malicious repository; once the system processes that repository, the path traversal is exercised and root‑level writes are performed. This can lead to full compromise of the affected system.