CVE-2026-34978 Details
Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches.
A path traversal vulnerability has been identified in OpenPrinting CUPS versions through 2.4.16, specifically within the RSS notifier's 'notify-recipient-uri' parameter. This vulnerability allows a remote IPP client to write RSS XML data to locations outside the designated CacheDir/rss directory, taking advantage of the fact that CacheDir is group-writable by default. The notifier, which operates under the 'lp' user, can overwrite root-managed state files by using a temporary file approach combined with renaming. Exploiting this vulnerability clobbers the CacheDir/job.cache file, causing the CUPS scheduler to fail in parsing the job cache and resulting in the loss of previously queued jobs.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openprinting cups | <= 2.4.16 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | New CVE Received | [email protected] |