Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61702— OpenPrinting CUPS: root-side banner file disclosure

Quick assessment

Affected
OpenPrinting cups
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenPrinting CUPS 是用于 Linux 及其他类 Unix 操作系统的开源打印系统。在 2.4.20 版本之前，scheduler/ipp.c 中的 copy_banner() 函数在处理作业表（job-sheets）横幅时，会将攻击者可控制的 IPP 属性中的“自然语言（natural-language）”值用作 DataDir/banners 目录下的子目录组件。首先，作业表值必须匹配已注册的横幅基本文件名（basename），且遍历的路径必须包含一个可匹配且可达的基本文件名；此外，选择任意目标

CVSS 5.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenPrinting cups < 2.4.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61702

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenPrinting CUPS: root-side banner file disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenPrinting cups < 2.4.20 -

II. Public POCs for CVE-2026-61702

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61702

请登录查看更多情报信息。

Other References for CVE-2026-61702 (4)

Same Patch Batch · OpenPrinting · 2026-10-15 · 4 CVEs total

CVE-2026-55480 5.7 MEDIUM CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TO
CVE-2026-55453 3.3 LOW CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as
CVE-2026-55467 2.5 LOW CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete f

IV. Related Vulnerabilities

Same product: cups
Same vendor: OpenPrinting
Same weakness: CWE-22

V. Comments for CVE-2026-61702

No comments yet

Leave a comment