CVE-2026-61702
Received Received - Intake

Path Traversal in OpenPrinting CUPS

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-61702
EUVD
EUVD-2026-102208

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenPrinting cups < 2.4.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61702 is a vulnerability in OpenPrinting CUPS versions before 2.4.20. It involves the scheduler using an attacker-controlled IPP attribute-natural-language value as a directory component for banner files. Path separators in this value can escape the intended banner directory, allowing the scheduler to access and copy bytes from arbitrary files. This could lead to root-side file disclosure under specific conditions.

Detection Guidance

Check CUPS version with 'cups-config --version' or 'dpkg -l cups'. If version is 2.4.19 or earlier, the system is vulnerable. Monitor for unusual banner file access in CUPS logs or filesystem activity under DataDir/banners.

Impact Analysis

An attacker could exploit this to read sensitive files on the system running vulnerable CUPS versions. They would need to create a local CUPS queue, set up a symlink, and submit a print job with a manipulated language attribute. The impact is limited to file content disclosure within the Docker environment, not full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Exposure of confidential files may result in regulatory penalties, reputational damage, and legal consequences depending on the data involved.

Mitigation Strategies

Upgrade CUPS to version 2.4.20 or later immediately. Disable unnecessary CUPS services if not in use. Restrict local CUPS queue creation and symlink preconditions. Review and restrict access to DataDir/banners directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart