OpenPrinting pappl-retrofit: Directory traversal in PPD file upload and deletion

Summary

pappl-retrofit, a printer application that provides access to legacy printer drivers, does not properly sanitize user-supplied filenames when uploading or deleting PostScript Printer Description (PPD) files. According to the CVE record, an attacker can use path traversal sequences to upload or delete arbitrary files, which can lead to data corruption, denial of service or arbitrary command execution. Red Hat states that exploitation requires the service to be running and the directory /var/lib/legacy-printer-app/ppd to be manually provisioned. The CVSS vector requires high privileges, which conflicts with the description's unauthenticated attacker; this is unresolved.

Affected

• OpenPrinting pappl-retrofit: 0 through 1.0b2
• Red Hat Enterprise Linux 10: listed as unaffected
• Default installations are not vulnerable according to Red Hat, unless the PPD storage directory is manually created

Fixed in

Unknown.

• Upstream GitHub PR #66 rejects PPD names containing a slash or parent-directory sequence. Its merge and release status is not confirmed.
• Distribution fix status is unknown.

Workaround

• Do not create /var/lib/legacy-printer-app/ppd unless it is required.
• Stop or disable the service if it is not used.
• Restrict network access to the web interface to trusted administrator hosts.
• Review file permissions of the service account.
• Red Hat states that no official mitigation is available for this issue.

Exploitation

Unknown. No public proof-of-concept, CISA KEV listing or vendor statement on in-the-wild exploitation was found. OffSeq lists the flaw as not known to be exploited. The record was published recently, so the status may change.

Our recommendation

• Inventory all hosts running pappl-retrofit or legacy-printer-app, including Fedora, Ubuntu, Arch and source builds.
• Check whether /var/lib/legacy-printer-app/ppd exists and whether the service listens on the network.
• Disable the service or restrict access where it is not needed, until a fixed build is confirmed.
• Recheck the Red Hat advisory, NVD and PR #66 for a merged fix and release version.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-123747 www.cve.org
• Red Hat CVE page CVE-2026-123747 access.redhat.com
• Red Hat Bugzilla 2568110 bugzilla.redhat.com
• OpenWall oss-security post www.openwall.com
• Upstream pappl-retrofit PR #66 github.com
• OffSeq threat radar CVE-2026-123747 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:36.