Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55467— CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

Quick assessment

Affected
OpenPrinting cups
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenPrinting CUPS 是用于 Linux 及其他类 Unix 操作系统的开源打印系统。在 2.4.20 版本之前，scheduler/job.c 中的 cupsdCreateJob 选项字符串构建器将攻击者可控制的 destination-uri 和 pre-dial-string 值（来自配置的传真队列）映射到 phone 和 faxPrefix 选项。与普通 IPP 作业属性不同，这些映射后的传真值会绕过控制字符清理器，并直接复制到过滤器选项参数中。因此，被授权提交作业的用户可以向下游选项流中注入

CVSS 2.5 · Low EPSS 0.17% · P6

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenPrinting cups < 2.4.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55467

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenPrinting cups < 2.4.20 -

II. Public POCs for CVE-2026-55467

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55467

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55467 (2)

Vendor Advisories for CVE-2026-55467 (1)

Same Patch Batch · OpenPrinting · 2026-10-15 · 4 CVEs total

CVE-2026-55480 5.7 MEDIUM CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TO
CVE-2026-61702 5.3 MEDIUM OpenPrinting CUPS: root-side banner file disclosure
CVE-2026-55453 3.3 LOW CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as

IV. Related Vulnerabilities

Same product: cups
Same vendor: OpenPrinting
Same weakness: CWE-93

V. Comments for CVE-2026-55467

No comments yet

Leave a comment