CVE Alert: CVE-2026-123747 – OpenPrinting – pappl

A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.

**Risk verdict:** Treat this as a high operational risk on exposed print-management hosts; exploitation urgency is uncertain because KEV, SSVC, EPSS and PoC status are not supplied.

**Why this matters:** Successful file manipulation could disrupt printing or damage files beyond the service’s intended storage area, with potential knock-on effects for the host or connected workflows. The available scoring implies substantial access and interaction barriers, but the advisory’s unauthenticated-attacker claim conflicts with the high-privilege requirement; validate which applies to your deployment.

**Most likely attack path:** An attacker can reach the service over the network, but the scoring suggests they need elevated privileges and a user to take an action, while exploitation is also considered complex. Changed scope indicates impact may extend beyond the vulnerable component; assess service-account permissions and accessible files to gauge lateral effects.

**Who is most exposed:** Prioritise organisations running network-accessible print-management services, especially where administrators or support staff can be induced to handle attacker-controlled file operations.

Alert on traversal sequences or unexpected absolute paths in upload and deletion requests.

Review web and application logs for unusual PPD file operations and repeated failures.

Check for unexpected file changes outside the service’s designated storage directory.

Monitor the service account for anomalous file access or child processes.

Mitigation and prioritisation

Apply the vendor’s fixed package as soon as available; confirm the affected package status for each platform.

Until patched, restrict network access to trusted management hosts and limit service-account file permissions.

Require validation of administrative actions and investigate suspicious file changes.

Use a maintenance window to test printing workflows after updating; obtain KEV, SSVC, EPSS and PoC status to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.