CVE-2026-95511: Cups: cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root)
A local privilege escalation exists in the CUPS printing stack used on Red Hat products. The cupsd scheduler decides that a backend runs as root based only on file permission bits (mode 0744 or 0700). Device URI validation in scheduler/ipp.c applies FileDevice path restrictions only to file: URIs. For other schemes, cupsd only checks that the backend binary exists and is executable. It does not validate the path component of the URI.
The serial backend, historically part of Apple CUPS, is not present in OpenPrinting CUPS HEAD (v2.5b1, commit 7cf4b97). Red Hat and Fedora ship it from the cups-filters package as /usr/lib/cups/backend/serial (or /usr/libexec/cups/backend/serial), installed root:root mode 0700 (RHEL 10 uses 0744). That mode still causes cupsd to run the backend as root. An lpadmin (SystemGroup) user can therefore configure a serial: device URI that causes a root-privileged backend to write job data to an attacker-chosen path, including cups-files.conf. cups-files.conf is otherwise protected from lpadmin HTTP PUT (restricted to cupsd.conf).
Impact: local privilege escalation from CUPS administrator (lpadmin) to OS root when the serial backend is installed.
Affected packaging: cups-filters serial backend on Fedora 43/44/45 and RHEL 8/9/10 (c8s/c9s/c10s specs). OpenPrinting CUPS core on HEAD does not build serial.
Fix: not yet available from upstream for this chain.
Reporter: Akiyoshi Kurita (Red Hat), forwarding the public cups2root report by v12-security. PSIRT Ticket: PSIRTSUPT-24165
Other sources
Rejected reason: Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.
— NVD
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who is a CUPS administrator through the SystemGroup, such as an lpadmin user, can exploit it. The issue escalates that existing CUPS administrative privilege to operating-system root.
Which installations are exposed?
Red Hat and Fedora systems are exposed when the cups-filters serial backend is installed at /usr/lib/cups/backend/serial or /usr/libexec/cups/backend/serial. The backend is shipped root-owned with mode 0700 on affected distributions, or 0744 on RHEL 10; both modes cause cupsd to run it as root.
What does an attacker need to do to reach root?
The attacker must be able to configure a serial: device URI through CUPS administration. They can use an attacker-chosen path in that URI so the root-privileged serial backend writes print job data to that path, including cups-files.conf.
How can I check whether a host is affected?
Check whether the serial backend exists and is executable at /usr/lib/cups/backend/serial or /usr/libexec/cups/backend/serial. Also identify accounts in the CUPS SystemGroup or otherwise able to use lpadmin, since those accounts are the relevant local attackers.