Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55453— CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip

Quick assessment

Affected
OpenPrinting cups
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenPrinting CUPS 是用于 Linux 及其他类 Unix 操作系统的开源打印系统。在 2.4.20 版本之前，后端文件 backend/ipp.c 中的 quote_string() 函数会在调用 report_attr() 将值写入调度器状态流之前，保留由远程打印机控制的标记消息中的回车符（CR）和换行符（LF）。调度器可能将注入的换行符解析为独立的 PPD 控制行，从而持久化攻击者选定的 PPD 关键字。报告者证明，在基于 Foomatic 的打印队列中，后续的打印作业可能会使用注入的 Foo

CVSS 3.3 · Low

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenPrinting cups < 2.4.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55453

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenPrinting cups < 2.4.20 -

II. Public POCs for CVE-2026-55453

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55453

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55453 (2)

Vendor Advisories for CVE-2026-55453 (1)

Same Patch Batch · OpenPrinting · 2026-10-15 · 4 CVEs total

CVE-2026-55480 5.7 MEDIUM CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TO
CVE-2026-61702 5.3 MEDIUM OpenPrinting CUPS: root-side banner file disclosure
CVE-2026-55467 2.5 LOW CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete f

IV. Related Vulnerabilities

Same product: cups
Same vendor: OpenPrinting
Same weakness: CWE-74

V. Comments for CVE-2026-55453

No comments yet

Leave a comment