Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55480— CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

Quick assessment

Affected
OpenPrinting cups
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenPrinting CUPS 是用于 Linux 及其他类 Unix 操作系统的开源打印系统。在 2.4.20 版本之前，scheduler/ipp.c 中的 copy_model() 函数会在一个允许 lp 组用户写入的目录中创建一个可预测的路径 TempDir/<连接编号>.ppd，并以 root 权限打开该文件，且未使用 O_EXCL 或 O_NOFOLLOW 标志。 该漏洞的利用需要满足以下条件：首先，存在一个能够写入该目录的 lp 组成员进程，用于预测基于连接编号生成的文件名，并在 root 进程打

CVSS 5.7 · Medium EPSS 0.16% · P4

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenPrinting cups < 2.4.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55480

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenPrinting cups < 2.4.20 -

II. Public POCs for CVE-2026-55480

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55480

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55480 (2)

Vendor Advisories for CVE-2026-55480 (1)

Same Patch Batch · OpenPrinting · 2026-10-15 · 4 CVEs total

CVE-2026-61702 5.3 MEDIUM OpenPrinting CUPS: root-side banner file disclosure
CVE-2026-55453 3.3 LOW CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as
CVE-2026-55467 2.5 LOW CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete f

IV. Related Vulnerabilities

Same product: cups
Same vendor: OpenPrinting
Same weakness: CWE-59

V. Comments for CVE-2026-55480

No comments yet

Leave a comment