OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cups | Apr 29, 2026 | Apr 3, 2026 |
| Amazon Linux Ami 2 | — | Upgrade cups-lpdUpgrade cups-clientUpgrade cups-develUpgrade cups-filesystemUpgrade cups-libsUpgrade cupsUpgrade cups-debuginfoUpgrade cups-ipptool | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade cups-lpd-debuginfoUpgrade cups-debugsourceUpgrade cupsUpgrade cups-clientUpgrade cups-lpdUpgrade cups-develUpgrade cups-filesystemUpgrade cups-printerapp-debuginfoUpgrade cups-libs-debuginfoUpgrade cups-ipptool-debuginfoUpgrade cups-printerappUpgrade cups-ipptoolUpgrade cups-debuginfoUpgrade cups-client-debuginfoUpgrade cups-libs | May 4, 2026 | Apr 3, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Apr 3, 2026 |
| Ubuntu | — | Upgrade cupsUpgrade cups-daemon | Jun 9, 2026 | Jun 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub