Directory Traversal Flaw in OpenPrinting CUPS Affects Linux Printing Systems

CVE-2026-61702

What is CVE-2026-61702?

OpenPrinting CUPS, an open-source printing system for Linux and Unix-like operating systems, is susceptible to a directory traversal flaw in its handling of job-sheets banners. The issue arises from the copy_banner() function in the scheduler/ipp.c file, where user-controlled IPP attributes can manipulate filesystem paths during processing. If an attacker crafts a malicious IPP attribute with appropriate path separators, they could potentially escape the designated banner directory. This vulnerability allows an attacker to read arbitrary files within the filesystem, which may lead to the exposure of sensitive information. The flaw has been mitigated in version 2.4.20, emphasizing the importance of keeping the software up to date to prevent exploitation.

References