TI-2026-27200 Aliases CVE-2026-34978

Path traversal in OpenPrinting cups

HIGH 68CWE-22Published 2026-04-03 · Updated 2026-04-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00422 36th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenPrinting	cups	up to 2.4.16	—	No fix listed	CNA

cups VendorOpenPrinting Affected up to 2.4.16 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openprinting:cups::::::::	up to 2.4.16	Vulnerable	OpenPrinting

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions up to 2.4.16 Vulnerable ·OpenPrinting

Remediation

Red Hat 1 advisory

RHSA-2026:8814 Released 2026-04-17 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images cups-2.4.17-1.hum1@aarch64, cups-2.4.17-1.hum1@src, cups-2.4.17-1.hum1@x86_64 +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:8814

Timeline

2026-10-02 Threatist record created from CVE-2026-34978

References

Exploit 1

https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr

TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3
TI-2025-38265 OpenPrinting CUPS vulnerable to stack based out-of-bound write CVSS 3.1MEDIUM 6.7

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences