CVE-2026-61702: OpenPrinting CUPS: root-side banner file disclosure
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenPrinting CUPSto a version that resolves this vulnerability.Fixed in 2.4.20
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
CUPS versions prior to 2.4.20 are affected when the scheduler processes a job using a job-sheets banner. Exploitation is constrained by the scheduler's filesystem and sandbox access and requires a configured backend that can deliver the resulting job-sheet data to an attacker-observable endpoint.
What does an attacker need to exploit the file disclosure?
An attacker can supply a crafted IPP attributes-natural-language value containing path separators, but the requested job-sheets value must first match a registered banner basename. The traversed path must also contain a matching reachable basename; disclosing an arbitrary selected target additionally requires pre-positioned path state, such as a symlink with that basename.
What can be disclosed if exploitation succeeds?
The root scheduler can open a reachable file and copy its bytes into a job-sheet spool object. The disclosed content is limited by the scheduler's filesystem and sandbox permissions and by whether the output can reach an attacker-observable backend endpoint.
What is the remediation?
Upgrade OpenPrinting CUPS to version 2.4.20, which fixes this issue.