PAPPL-RETROFIT · CVE-2026-123747 · Other
FIX → 1.0b3 ✓ verified
pappl-retrofit does not sanitize filenames when uploading or deleting PostScript Printer Description (PPD) files. A remote attacker with no login can use path traversal sequences in filenames to upload or delete arbitrary files, which can lead to data corruption, denial of service, or command execution.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run the legacy-printer-app from pappl-retrofit 1.0b2 or older as a service. The maintainer found it on an Ubuntu system where it runs as root, with no authentication, listening on 0.0.0.0:8000. Anyone who can reach the web interface can upload or delete files outside the PPD folder, and can reach command execution by uploading a PPD with a cupsFilter, adding a printer and printing a test page. Red Hat says default RHEL 10, CentOS Stream 10 and Fedora installs are not exposed because the package does not create the ppd directory. Skip it if you do not run legacy-printer-app.
Not affected if auth-required, pappl-retrofit-not-deployed, ppd-dir-not-created, service-not-running
Who cares cups, legacy-printer-app, linux, pappl-retrofit, printers, self-hosted
legacy-printer-app --version or check your package version (e.g. dpkg -l | grep pappl-retrofit, rpm -q pappl-retrofit); versions <= 1.0b2 are affectedPosts are quoted with a link to the original. They are data to us, never instructions.
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.0b3
Reject PPD names that leave the upload directory, PR #66)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.