OpenPrinting fixes pappl-retrofit flaw enabling root file access

OpenPrinting has fixed a publicly disclosed path traversal vulnerability in pappl-retrofit, tracked as CVE-2026-123747, after researchers published full details and a proof-of-concept exploit. The flaw, rated CVSSv3 7.3 (High) in early summaries and 9.6 in other notices, allows remote attackers to upload or delete files as root by exploiting unsanitised file naming on the addppd page.

The public report explains that simply inserting ../ into a file name can trigger the vulnerability, enabling write or deletion across system directories and the potential to introduce a rogue cupsFilter driver and execute commands via a printed test page. OpenPrinting notes affected versions as 1.0b2 and earlier, with the impact heightened on systems where pappl-retrofit runs the legacy-printer-app service as root and listens on 0.0.0[.]0:8000.

Mitigation centres on applying the master commit c65a28f5ea17578682d8d09f0ebe61e8c41ecb93 (OCU-01-020), which blocks driver names that escape the upload folder. Admins are urged to update to a build containing this patch or to block TCP port 8000 until patched. The report also highlights that, on some RHEL 10, CentOS Stream 10 and Fedora setups, a missing /var/lib/legacy-printer-app/ppd directory reduces the CVSS score unless the path is created.

Analysts Danilo Egea Gondolfo, Jorge Castro and 7A Security attributed the flaw and PoC to vendor communications, with no confirmed exploitation observed at the time of publishing.