pappl-retrofitに重大な脆弱性、修正を含む1.0b3が公開
Summary
プリンターアプリケーション基盤のpappl-retrofitで、PPDファイルの追加・削除の機能にディレクトリトラバーサルの脆弱性が公表されました。対象は1.0b2以前で、修正を含む1.0b3が公開されています。利用の有無を確かめ、1.0b3か配布元の更新版へ上げてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
プリンターアプリケーション基盤のpappl-retrofitで、PPDファイルの追加・削除の機能にディレクトリトラバーサルの脆弱性が公表されました。対象は1.0b2以前で、修正を含む1.0b3が公開されています。利用の有無を確かめ、1.0b3か配布元の更新版へ上げてください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| OpenPrintingpappl-retrofit |
≤ 1.0b2→ Not listed |
Not listed |
| Red HatRed Hat Enterprise Linux 10 | — | Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Ubuntu UBUNTU-CVE-2026-123747 pappl-retrofit No fixed version in this record
Original description The description as published by the source.
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
Source: oss-security (Openwall) NVD
References
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- OSS-SECURITY CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions
- package github.com
- report bugzilla.redhat.com
- web openwall.com
- web access.redhat.com