CVE-2026-34978
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In OpenPrinting CUPS versions 2.4.16 and prior, the RSS notifier allows path traversal in notify-recipient-uri, enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss to any lp-writable location. By exploiting default group-writable permissions (root:lp, mode 0770), the notifier running as lp can overwrite root-managed state files, causing job cache parsing failures and loss of queued jobs after cupsd restart.
Risk Assessment
An attacker can remotely corrupt or delete printing system state files, leading to loss of queued jobs and potential service disruption. The lack of publicly available patches increases exploitation risk in production environments.
Recommendation
Immediately restrict CacheDir permissions (e.g., change mode to 0750) and block unauthorized RSS URIs in CUPS configuration. Consider disabling the RSS notifier temporarily until an official patch is released.
Original NVD description (English source)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches.