CVE-2026-123747 pappl-retrofit: directory traversal in add/delete-ppdfiles actions lets attackers write/delete arbitrary files
Severity: critical · Patch status: patched · Since 2026-11-11 · CVE-2026-123747
Zdenek Dohnal of Red Hat announced a critical (CVSS 9.6) directory traversal vulnerability in OpenPrinting's pappl-retrofit on 2026-11-11, tracked as CVE-2026-123747. The flaw affects the add-ppdfiles and delete-ppdfiles actions, allowing attackers to traverse directories and likely write or delete files outside the intended path on systems running the affected service. Details and the fixing commit are published in GitHub advisory GHSA-wxj6-x3wg-4vmc. No in-the-wild exploitation is reported. A patched release was stated to ship shortly after the announcement; organisations running pappl-retrofit (used to retrofit PPD support into pappl-based print servers, notably in CUPS ecosystem deployments) should update as soon as the fixed version is available.
What to do
- Monitor for the patched pappl-retrofit release and upgrade immediately when published
- Review the GitHub advisory GHSA-wxj6-x3wg-4vmc and apply the fix commit if building from source
- Restrict network access to pappl-retrofit admin/web interfaces until patched
- Check logs for suspicious add-ppdfiles/delete-ppdfiles requests indicating exploitation
Sources
All live incidents on Threat Watch
