---
id: "CVE-2026-123747"
page: "https://infrastack.ai/live/CVE-2026-123747"
kind: "vulnerability"
aliases: ["CVE-2026-123747"]
title: "pappl-retrofit legacy-printer-app: path traversal in PPD upload/delete lets network attackers write or delete any file"
severity: "critical"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "pappl-retrofit", "fixed": ["1.0b3"], "affected": "<= 1.0b2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cups", "legacy-printer-app", "linux", "other", "pappl-retrofit", "printers", "self-hosted"]
not_affected_if: ["auth-required", "pappl-retrofit-not-deployed", "ppd-dir-not-created", "service-not-running"]
published_at: "2026-11-11T19:17:30+00:00"
first_seen_at: "2026-11-11T19:28:45+00:00"
updated_at: "2026-11-11T19:33:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123747", "first_seen_at": "2026-11-11T19:28:45+00:00"}, {"source": "analyst", "url": "https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc", "first_seen_at": "2026-11-11T19:33:28+00:00", "cites": ["https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc", "https://access.redhat.com/security/cve/CVE-2026-123747", "https://github.com/OpenPrinting/pappl-retrofit/releases"]}]
exploit_sources: []
---

# pappl-retrofit legacy-printer-app: path traversal in PPD upload/delete lets network attackers write or delete any file

Link for people: https://infrastack.ai/live/CVE-2026-123747 (this .md is for agents)

pappl-retrofit does not sanitize filenames when uploading or deleting PostScript Printer Description (PPD) files. A remote attacker with no login can use path traversal sequences in filenames to upload or delete arbitrary files, which can lead to data corruption, denial of service, or command execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:pappl-retrofit affected <= 1.0b2 fixed 1.0b3

## How to check

Run 'legacy-printer-app --version' or check your package version (e.g. dpkg -l | grep pappl-retrofit, rpm -q pappl-retrofit); versions <= 1.0b2 are affected. Check whether the legacy-printer-app service is running (systemctl status legacy-printer-app) and listening, e.g. ss -ltnp | grep 8000. On RHEL 10, CentOS Stream 10 and Fedora, you are only exposed if /var/lib/legacy-printer-app/ppd was created by an admin.

## Fix

Upgrade pappl-retrofit to 1.0b3 (commit c65a28f 'Reject PPD names that leave the upload directory', PR #66). No other workaround is published. Until upgraded, stop the legacy-printer-app service or block port 8000 from untrusted networks.

## Timeline

- 2026-11-11T19:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123747
- 2026-11-11T19:33:28+00:00 analyst https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc — Upstream GHSA-wxj6-x3wg-4vmc (maintainer rates Critical 9.6; Red Hat rates 7.3 for RHEL/Fedora because the ppd dir is not created). Affected <= 1.0b2; fixed in 1.0b3 per release notes (advisory page still says Patched: None). Severity raised to critical on the maintainer's rating for the default unauth root listener on Ubuntu. No exploitation reports seen; PoC curl is in the advisory.

## Documents

- [advisory] GHSA-wxj6-x3wg-4vmc: Directory traversal in add-ppdfiles and delete-ppdfiles https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc
- [describes] Red Hat: CVE-2026-123747 https://access.redhat.com/security/cve/CVE-2026-123747
- [fix] pappl-retrofit 1.0b3 release notes https://github.com/OpenPrinting/pappl-retrofit/releases

## From the sources

A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_