TI-2026-74871 Aliases CVE-2026-55480

Symlink race in CUPS PPD tempfile lets lp users overwrite root files

MEDIUM 59CWE-377Published 2026-10-15 · Updated 2026-10-20

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

OpenPrinting CUPS before 2.4.20 has a link-following flaw (CWE-59) in an insecure temporary file (CWE-377). The copy_model() function in scheduler/ipp.c creates a predictable temporary PPD file without O_EXCL or O_NOFOLLOW. A local user in the lp group who can write the directory can plant a symlink before the root scheduler opens the file during a privileged add-printer or modify-printer operation, and the root scheduler then overwrites the symlink target, a root-writable file, with generated PPD data. A proof-of-concept exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00202 10th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial cups (OpenPrinting): 2.4.20Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenPrinting	cups	before 2.4.20	2.4.20	Patch available	CNA

cups VendorOpenPrinting Affected before 2.4.20 Fixed in 2.4.20 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openprinting:cups::::::::	before 2.4.20	Vulnerable	OpenPrinting

cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions before 2.4.20 Vulnerable ·OpenPrinting

Remediation

Update CUPS to version 2.4.20. Red Hat fixes this in Red Hat Hardened Images through RHSA-2026:84421. Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are affected and Red Hat lists no available plan for them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA cups (OpenPrinting) Fixed in 2.4.20

Red Hat 1 advisory

RHSA-2026:84421 Released 2026-10-17 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images cups-2.4.19-4.6.hum1@aarch64, cups-2.4.19-4.6.hum1@s390x, cups-2.4.19-4.6.hum1@src +22

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:84421

Timeline

2026-10-16 Threatist record created from CVE-2026-55480
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-20 Fix available: RHSA-2026:84421 · Red Hat
2026-10-20 CISA SSVC decision points changed
2026-10-20 Priority changed: LOW → MEDIUM
2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
2026-10-20 CVSS score added · Red Hat
2026-10-30 Affected versions changed · Red Hat

References

Exploit 1

https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9

Patch 2

Other 1

https://github.com/OpenPrinting/cups/releases/tag/v2.4.20

TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences