CVE-2026-61702
published 2026-10-15CVE-2026-61702: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the…
PriorityP433medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.47%
39.4th percentile
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | — | — |
| openprinting | cups | < 2.4.20 | 2.4.20 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-61702 cups: cups: Information disclosure via path traversal in banner processing
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-61702 [MEDIUM] CVE-2026-61702 cups: cups: Information disclosure via path traversal in banner processing
CVE-2026-61702 cups: cups: Information disclosure via path traversal in banner processing
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory,
Bugzilla
CVE-2026-107655 cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service [fedora-all]
bugzilla·2026-10-09·CVSS 4.0
CVE-2026-107655 [MEDIUM] CVE-2026-107655 cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service [fedora-all]
CVE-2026-107655 cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in CUPS when processing embedded job ticket comments in PostScript or PDF documents. The read_job_ticket() function in scheduler/ipp.c allows a job-ticket option named attributes-natural-language to replace the valid IPP operation attribute with a keyword attribute, because the replacement lookup does not restrict the attribute group. When the job starts, cupsdContinueJob() in scheduler/job.c looks up the attribute as IPP_TAG_LA
Bugzilla
CVE-2026-107655 cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service
bugzilla·2026-10-09·CVSS 4.0
CVE-2026-107655 [MEDIUM] CVE-2026-107655 cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service
CVE-2026-107655 cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service
A flaw was found in CUPS when processing embedded job ticket comments in PostScript or PDF documents. The read_job_ticket() function in scheduler/ipp.c allows a job-ticket option named attributes-natural-language to replace the valid IPP operation attribute with a keyword attribute, because the replacement lookup does not restrict the attribute group. When the job starts, cupsdContinueJob() in scheduler/job.c looks up the attribute as IPP_TAG_LANGUAGE and dereferences the NULL result without checking it. An unauthenticated client permitted to submit jobs to an accepting shared printer queue can send a single crafted IPP Print-Job request to crash cupsd before any document filter
https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2https://github.com/OpenPrinting/cups/releases/tag/v2.4.20https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g
2026-10-15
Published