CVE-2026-123747
Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
CVE-2026-123747 is a high vulnerability (CVSS 7.3) in Openprinting Pappl-retrofit, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. No source names a fixed version.
- Severity
- 7.3 HighCVSS 3.1, CVE List
- Exploit chance
- 1.23%EPSS, 69th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pappl-retrofitUbuntu:26.10 | All versions, plus listed versions 1.0~b2-0ubuntu8 | None known |
pappl-retrofitUbuntu:26.04:LTS | All versions, plus listed versions 1.0~b2-0ubuntu8 | None known |
What each source reports
CVE List Score used
Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
- Record
CVE-2026-123747- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-11
EUVDEUVD-2026-123700
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
- Record
EUVD-2026-123700- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-11
NVD
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
- Record
CVE-2026-123747- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-12
OSV
Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
- Record
CVE-2026-123747- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-123747
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
- Record
UBUNTU-CVE-2026-123747- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| affected, aliases, references | NVD, OSV | |
| references | CVE List, OSV | |
| references | NVD | |
| cwes, products, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/security/cve/CVE-2026-123747
bugzilla.redhat.com/show_bug.cgi?id=2568110
openwall.com/lists/oss-security/2026/11/11/9
github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123747.json
nvd.nist.gov/vuln/detail/CVE-2026-123747
ubuntu.com/security/CVE-2026-123747
cve.org/CVERecord?id=CVE-2026-123747