SB2026061742 - Multiple vulnerabilities in cups

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026061742

SB2026061742 - Multiple vulnerabilities in cups

Published: June 17, 2026 Updated: July 13, 2026

Security Bulletin ID SB2026061742
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-55453)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the CUPS ipp backend status reporting path and scheduler PPD update handling when processing text printer-status attributes from a remote IPP printer. A remote attacker can return a crafted printer-status attribute containing injected newline characters and a forged PPD status line to execute arbitrary code.

Successful exploitation requires a CUPS queue that points to an attacker-controlled or compromised IPP printer, a Foomatic-backed PPD or filter profile that invokes foomatic-rip, and a later print job that uses the modified PPD. The demonstrated code execution occurs as user lp.


2) CRLF injection (CVE-ID: CVE-2026-55467)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of CRLF sequences in cupsdCreateJob option-string builder in scheduler/job.c when processing fax queue job attributes from the destination-uris collection. A remote user can submit a crafted print job with malicious destination-uri or pre-dial-string values to execute arbitrary code.

Exploitation requires a configured FAX-type queue. Where the downstream fax filter does not pass these values into a shell or modem command context, the realized impact is limited to injection into the filter option stream.


3) Link following (CVE-ID: CVE-2026-55480)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to overwrite arbitrary root-owned files and escalate privileges.

The vulnerability exists due to improper link resolution before file access in copy_model() in scheduler/ipp.c when creating a predictable temporary PPD file in a group-writable temporary directory. A local privileged user can pre-create a symlink at the predicted tempfile path to overwrite arbitrary root-owned files and escalate privileges.

The issue depends on a predictable tempfile name derived from the sequential client connection identifier, and exploitation targets the add or modify printer code path.


4) Path traversal (CVE-ID: CVE-2026-61702)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in CUPS scheduler banner handling, root-side copy_banner() path construction when processing a print job with a crafted attributes-natural-language value during banner generation. A remote attacker can submit a specially crafted print job to disclose sensitive information.

Exploitation requires a banner-capable local queue processing job-sheets=standard,none, and the disclosed data is limited to files readable within the CUPS victim environment.


Remediation

Install update from vendor's website.

References