UBUNTU-CVE-2026-123747: Path Traversal
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can exploit it by interacting with the application's PPD file upload or deletion handling.
What does an attacker need to provide?
The attacker needs to submit a user-controlled filename containing path traversal sequences during a PPD file upload or deletion operation.
What could successful exploitation allow?
An attacker may be able to upload or delete arbitrary files on the system. The stated impacts include data corruption, denial of service, and possible arbitrary command execution.