{"id":"CVE-2026-123747","kind":"vulnerability","aliases":["CVE-2026-123747"],"related":[],"title":"pappl-retrofit legacy-printer-app: path traversal in PPD upload/delete lets network attackers write or delete any file","description":"A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.","summary":"pappl-retrofit does not sanitize filenames when uploading or deleting PostScript Printer Description (PPD) files. A remote attacker with no login can use path traversal sequences in filenames to upload or delete arbitrary files, which can lead to data corruption, denial of service, or command execution.","severity":"critical","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pappl-retrofit","fixed":["1.0b3"],"affected":"<= 1.0b2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cups","legacy-printer-app","linux","other","pappl-retrofit","printers","self-hosted"],"not_affected_if":["auth-required","pappl-retrofit-not-deployed","ppd-dir-not-created","service-not-running"],"how_to_check":"Run 'legacy-printer-app --version' or check your package version (e.g. dpkg -l | grep pappl-retrofit, rpm -q pappl-retrofit); versions <= 1.0b2 are affected. Check whether the legacy-printer-app service is running (systemctl status legacy-printer-app) and listening, e.g. ss -ltnp | grep 8000. On RHEL 10, CentOS Stream 10 and Fedora, you are only exposed if /var/lib/legacy-printer-app/ppd was created by an admin.","fix":"Upgrade pappl-retrofit to 1.0b3 (commit c65a28f 'Reject PPD names that leave the upload directory', PR #66). No other workaround is published. Until upgraded, stop the legacy-printer-app service or block port 8000 from untrusted networks.","status":"open","published_at":"2026-11-11T19:17:30+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:30:11+00:00","updated_at":"2026-11-11T19:33:28+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-11T19:30:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"pappl-retrofit: path traversal in PPD upload lets attackers write or delete files","impact":"high","summary":"pappl-retrofit does not sanitize filenames when uploading or deleting PostScript Printer Description (PPD) files. A remote attacker with no login can use path traversal sequences in filenames to upload or delete arbitrary files, which can lead to data corruption, denial of service, or command execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["pappl-retrofit","printers","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker writes or deletes arbitrary files, possibly running commands","analyst_note":"Confirm the affected versions and fixed release from the NVD entry and upstream project; check whether the PPD upload endpoint is exposed by default.","how_to_check":"unknown","plain_action":"","product_name":"pappl-retrofit","needs_analyst":true,"not_affected_if":["pappl-retrofit-not-deployed"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":4582,"output_tokens":446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected versions and fixed release from the NVD entry and upstream project; check whether the PPD upload endpoint is exposed by default.","search":"'-123747':23A,26A '-2026':22A,25A 'allow':139C 'app':7A,34B 'applic':100C 'arbitrari':77B,146C,161C 'attack':15A,62B,124C,141C 'command':89B,162C 'contain':134C 'corrupt':84B,156C 'cup':30B 'cve':21A,24A 'data':83B,155C 'delet':18A,54B,76B,114C,145C 'denial':85B,157C 'descript':57B,118C 'directori':128C 'execut':90B,163C 'exploit':126C 'fail':101C 'file':20A,59B,78B,120C,147C 'filenam':50B,72B,108C,133C 'flaw':92C,130C 'found':94C 'handl':110C 'host':43B 'lead':81B 'legaci':5A,32B 'legacy-printer-app':4A,31B 'let':13A 'linux':35B 'login':65B 'network':14A 'pappl':2A,28A,38B,45B,97C 'pappl-retrofit':1A,27A,37B,44B,96C 'path':8A,68B,135C 'postscript':55B,116C 'ppd':11A,58B,119C 'printer':6A,33B,40B,56B,117C 'proper':103C 'remot':61B,122C 'result':153C 'retrofit':3A,29A,39B,46B,98C 'sanit':49B,104C 'self':42B 'self-host':41B 'sequenc':70B,137C 'servic':87B,159C 'submit':132C 'suppli':107C 'system':150C 'travers':9A,69B,129C,136C 'unauthent':123C 'upload':52B,74B,112C,143C 'upload/delete':12A 'use':67B 'user':106C 'user-suppli':105C 'write':16A","nicknames":[],"mitigations":[],"who_affected":"Systems that run the legacy-printer-app from pappl-retrofit 1.0b2 or older as a service. The maintainer found it on an Ubuntu system where it runs as root, with no authentication, listening on 0.0.0.0:8000. Anyone who can reach the web interface can upload or delete files outside the PPD folder, and can reach command execution by uploading a PPD with a cupsFilter, adding a printer and printing a test page. Red Hat says default RHEL 10, CentOS Stream 10 and Fedora installs are not exposed because the package does not create the ppd directory. Skip it if you do not run legacy-printer-app.","tier":"B","verified":{"fix":{"at":"2026-11-11T19:33:28Z","by":"analyst","doc":"https://github.com/OpenPrinting/pappl-retrofit/releases","run_id":3589},"products":{"at":"2026-11-11T19:33:28Z","by":"analyst","doc":"https://github.com/OpenPrinting/pappl-retrofit/releases","run_id":3589},"how_to_check":{"at":"2026-11-11T19:33:28Z","by":"analyst","doc":"https://github.com/OpenPrinting/pappl-retrofit/releases","run_id":3589},"who_affected":{"at":"2026-11-11T19:33:28Z","by":"analyst","doc":"https://github.com/OpenPrinting/pappl-retrofit/releases","run_id":3589}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["papplretrofit"],"ptokens":["pappl","retrofit"],"labels":["critical","cups","legacyprinterapp","linux","other","papplretrofit","printers","selfhosted","vendor"],"campaign_type":null,"search_a":"'-123747':23A,26A '-2026':22A,25A 'app':7A 'attack':15A 'cve':21A,24A 'delet':18A 'file':20A 'legaci':5A 'legacy-printer-app':4A 'let':13A 'network':14A 'pappl':2A,28A 'pappl-retrofit':1A,27A 'path':8A 'ppd':11A 'printer':6A 'retrofit':3A,29A 'travers':9A 'upload/delete':12A 'write':16A","search_b":"'app':34B 'arbitrari':77B 'attack':62B 'command':89B 'corrupt':84B 'cup':30B 'data':83B 'delet':54B,76B 'denial':85B 'descript':57B 'execut':90B 'file':59B,78B 'filenam':50B,72B 'host':43B 'lead':81B 'legaci':32B 'legacy-printer-app':31B 'linux':35B 'login':65B 'pappl':38B,45B 'pappl-retrofit':37B,44B 'path':68B 'postscript':55B 'ppd':58B 'printer':33B,40B,56B 'remot':61B 'retrofit':39B,46B 'sanit':49B 'self':42B 'self-host':41B 'sequenc':70B 'servic':87B 'travers':69B 'upload':52B,74B 'use':67B","search_c":"'allow':139C 'applic':100C 'arbitrari':146C,161C 'attack':124C,141C 'command':162C 'contain':134C 'corrupt':156C 'data':155C 'delet':114C,145C 'denial':157C 'descript':118C 'directori':128C 'execut':163C 'exploit':126C 'fail':101C 'file':120C,147C 'filenam':108C,133C 'flaw':92C,130C 'found':94C 'handl':110C 'pappl':97C 'pappl-retrofit':96C 'path':135C 'postscript':116C 'ppd':119C 'printer':117C 'proper':103C 'remot':122C 'result':153C 'retrofit':98C 'sanit':104C 'sequenc':137C 'servic':159C 'submit':132C 'suppli':107C 'system':150C 'travers':129C,136C 'unauthent':123C 'upload':112C,143C 'user':106C 'user-suppli':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123747","severity":null,"published_at":"2026-11-11T19:17:30+00:00","modified_at":"2026-11-11T19:17:30+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123747:3589","url":"https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc","severity":null,"published_at":"2026-11-11T19:33:28+00:00","modified_at":"2026-11-11T19:33:28+00:00","first_seen_at":"2026-11-11T19:33:28+00:00","fetched_at":"2026-11-11T19:33:28+00:00","note":"Upstream GHSA-wxj6-x3wg-4vmc (maintainer rates Critical 9.6; Red Hat rates 7.3 for RHEL/Fedora because the ppd dir is not created). Affected <= 1.0b2; fixed in 1.0b3 per release notes (advisory page still says Patched: None). Severity raised to critical on the maintainer's rating for the default unauth root listener on Ubuntu. No exploitation reports seen; PoC curl is in the advisory.","cites":["https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc","https://github.com/OpenPrinting/pappl-retrofit/releases","https://access.redhat.com/security/cve/CVE-2026-123747"]}],"documents":[{"id":128322,"url":"https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc","title":"GHSA-wxj6-x3wg-4vmc: Directory traversal in add-ppdfiles and delete-ppdfiles","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":128324,"url":"https://github.com/OpenPrinting/pappl-retrofit/releases","title":"pappl-retrofit 1.0b3 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":128326,"url":"https://access.redhat.com/security/cve/CVE-2026-123747","title":"Red Hat: CVE-2026-123747","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}