Directory Traversal Vulnerability in Pappl-Retrofit Affects Red Hat
CVE-2026-123747

7.3HIGH

Key Information:

Vendor

Openprinting

Status
Pappl-retrofit
Red Hat Enterprise Linux 10
Vendor
CVE Published:
11 November 2026

What is CVE-2026-123747?

A flaw in the Pappl-Retrofit application has been identified, where the application does not properly sanitize user-supplied filenames during the upload and deletion of PostScript Printer Description (PPD) files. This vulnerability allows unauthorized remote attackers to exploit the application by submitting specially crafted filenames that include path traversal sequences. As a result, an attacker may upload or delete arbitrary files on the system, leading to potential data corruption, denial of service, or even arbitrary command execution.

Affected Version(s)

pappl-retrofit 0 <= 1.0b2

References

https://access.redhat.com/security/cve/CVE-2026-123747
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2568110
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.