Critical Path Traversal in OpenPrinting pappl-retrofit Allows Root File Manipulation (CVE-2026-123747)
A critical path traversal vulnerability, CVE-2026-123747, affecting OpenPrinting pappl-retrofit has been publicly disclosed along with proof-of-concept exploit code. This flaw enables remote attackers to upload or delete arbitrary files as root via unsanitized file names in the add-ppdfiles and delete-ppdfiles actions. The vulnerable service runs by default as root on port 8000 with no authentication, exposing Linux systems using pappl-retrofit, commonly installed via Ubuntu and other desktop distributions. Although no active exploitation in the wild has been confirmed, the publication of working exploits raises the risk significantly. Administrators should immediately apply the patch in commit c65a28f or block port 8000 to mitigate the vulnerability.
Entenda a falha
A vulnerabilidade
CVE-2026-123747 is a path traversal flaw (CWE-22) in OpenPrinting pappl-retrofit 1.0b2 and older, in the add-ppdfiles and delete-ppdfiles actions of the legacy-printer-app service. A remote attacker with network access to port 8000 needs no authentication and no user interaction. They can upload or delete arbitrary files as root, and the articles say an attacker can plant a rogue driver with a cupsFilter rule and print a test page to run root commands. The score is CVSS 9.6 (critical). On RHEL 10, CentOS Stream 10 and Fedora a packaging bug omits the /var/lib/legacy-printer-app/ppd folder, which lowers the score to 7.3 (High) unless root creates the path. The fix is in master commit c65a28f.
Como funciona
The pappl-retrofit tool adapts old CUPS printer drivers for modern Linux systems. Its legacy-printer-app service runs as root by default, listens on 0.0.0.0:8000 and does not check for a login. When a driver (PPD) file is uploaded or deleted through the /addppd page, the service takes the supplied file name and joins it directly to the base driver folder path. Because the name is not checked, path separators inside it make the final path leave that folder, and the write or delete happens wherever the path points, with root privileges.
Por que é vulnerável
The root cause is missing validation of user-supplied file names: the code trusts the name and appends it to the base folder without confirming the result stays inside it. This is made worse by the insecure defaults of a root-run service exposed on all interfaces with no authentication. The articles do not say why it went unnoticed. The fix, tracked as OCU-01-020, blocks driver names that leave the upload folder.
Onde está
The /addppd page and its add-ppdfiles and delete-ppdfiles actions in the legacy-printer-app service; fixed in pappl-retrofit master commit c65a28f (OCU-01-020).
Como foi descoberta
According to the articles, the flaw was reported by Danilo Egea Gondolfo, Jorge Castro and 7A Security. The full details and proof-of-concept were then disclosed publicly, and OpenPrinting developers fixed it afterwards in commit c65a28f. The articles do not say how it was originally found or when it was reported to the vendor. No exploitation in the wild has been confirmed.
PoC pública
The public report includes working proof-of-concept exploit commands, so exploit details are available to anyone. The report says that adding ../ to the file name is enough to trigger the flaw, and that it can upload a file to any directory and delete any file. Mind the exposure: no in-the-wild attacks are confirmed, but unpatched hosts reachable on port 8000 are at high risk, so apply the fix or stop the service or firewall the port now.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 23:15.
Linha do tempo
-
Critical Path Traversal in OpenPrinting pappl-retrofit Allows Root File Manipulation (CVE-2026-123747)
ler a análise desta fonte ocultar
A critical path traversal vulnerability, CVE-2026-123747, affecting OpenPrinting pappl-retrofit has been publicly disclosed along with proof-of-concept exploit code. This flaw enables remote attackers to upload or delete arbitrary files as root via unsanitized file names in the add-ppdfiles and delete-ppdfiles actions. The vulnerable service runs by default as root on port 8000 with no authentication, exposing Linux systems using pappl-retrofit, commonly installed via Ubuntu and other desktop distributions. Although no active exploitation in the wild has been confirmed, the publication of working exploits raises the risk significantly. Administrators should immediately apply the patch in commit c65a28f or block port 8000 to mitigate the vulnerability.