CVE-2026-123747

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123747", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-11-06T12:52:36.636Z", "datePublished": "2026-11-11T18:31:49.765Z", "dateUpdated": "2026-11-12T17:56:17.866Z"}, "containers": {"cna": {"title": "Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution."}], "affected": [{"vendor": "OpenPrinting", "product": "pappl-retrofit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0b2"}], "packageName": "pappl-retrofit", "collectionURL": "https://github.com/OpenPrinting/pappl-retrofit", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "pappl-retrofit", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-123747", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568110", "name": "RHBZ#2568110", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-11T11:11:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "timeline": [{"lang": "en", "time": "2026-11-06T12:48:52.377Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-11T11:11:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-11T18:31:49.765Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/11/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-11T19:05:08.251Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T16:27:18.931846Z", "id": "CVE-2026-123747", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T17:56:17.866Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/OpenPrinting/pappl-retrofit", "defaultStatus": "unaffected", "packageName": "pappl-retrofit", "product": "pappl-retrofit", "vendor": "OpenPrinting", "versions": [{"lessThanOrEqual": "1.0b2", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "pappl-retrofit", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution."}], "id": "CVE-2026-123747", "lastModified": "2026-11-12T18:17:20.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.8, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123747", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T16:27:18.931846Z", "version": "2.0.3"}}]}, "published": "2026-11-11T19:17:30.467", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-123747"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568110"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/11/9"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions", "id": "2568110", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568110"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-123747", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "pappl-retrofit", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-11-11T11:11:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123747\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123747"], "statement": "Red Hat has evaluated this vulnerability as having an Important severity impact because unauthenticated remote attackers could manipulate or delete arbitrary filesystem contents with elevated privileges if the service is exposed. On Red Hat Enterprise Linux and Fedora, the required storage directory `/var/lib/legacy-printer-app/ppd` is not created by the package, meaning default installations are not vulnerable without manual administrative setup. Exploitation is only possible if the service is actively running and this missing directory has been manually provisioned with administrative privileges.", "threat_severity": "Important"}

{"created": "2026-11-12T14:00:03.700963+00:00", "updated": "2026-11-13T12:00:10.055858+00:00", "vendors": []}