CVE-2026-123747: Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
Other sources
Summary Today I stumbled upon an Ubuntu system running the legacy-printer-app service. It turns out it runs as root, unauthenticated by default and listen on 0.0.0.0:8000.
After looking at it for a moment I have found that the upload and deletion of PPDs is vulnerable to directory traversal. It can be used to upload a file to any directory in the system AND delete any file too.
I also want to add that by allowing unauthenticated users to upload PPDs, adding printers and triggering printing jobs also allows malicious users to run arbitrary commands in the system through cups filters. All you need to do is upload a PPD that run a command with the cupsFilter setting, add a printer using the driver and print a test page.
Details To trigger the vulnerability one just need to add ../ to the file name. The filename, for example ../../../../../etc/passwd, will be concatenated with the base directory used to store PPDs without sanitization.
PoC $ HOST=172.16.0.25:8000 $ token=$(curl ${HOST}/addppd 2>/dev/null | grep 'name="session"' | tail -n 1 | awk '{print $4}' | grep -Eo '"."' | tr -d '"') $ curl -d "session=${token}&%09/../../../../../etc/wgetrc=on&action=delete-ppdfiles" http://${HOST}/addppd Impact Anyone who can connect to the application through the network can upload malicious files and destroy the system by deleting arbitrary files. RHEL 10, Centos Stream 10 and Fedora are not affected until the dir /var/lib/legacy-printer-app/ppd is created (which requires root permissions to create that dir), because the dir is not installed by OS due packaging error, so severity for those platform is HIGH (CVSS 7.3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H) - because root is needed to create the dir.
— Red Hat