CVE-2026-123747

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-123747
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123747.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-123747
Downstream
Published
2026-11-11T18:31:49Z
Modified
2026-11-13T02:46:49Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H CVSS Calculator
Summary
Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
Details

A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123747.json"
}
References

Affected packages

Git / github.com/openprinting/pappl-retrofit

Affected ranges

Type
GIT
Repo
https://github.com/openprinting/pappl-retrofit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
77233b62059773cf93ce1fd0eeeae6fe488f2d45
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "1.0b2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

1.*
1.0b1
1.0b2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123747.json"