pappl-retrofit directory traversal in PPD actions (CVE-2026-123747)
Original title: CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions
The flaw affects add-ppdfiles and delete-ppdfiles, with a fix planned for a release soon after the advisory.
Zdenek Dohnal reported CVE-2026-123747 in pappl-retrofit, a directory traversal in the add-ppdfiles and delete-ppdfiles actions. The announcement points to an OpenPrinting GitHub advisory. Dohnal said the fix will ship in a new release shortly after the post. The mailing-list note gives no affected version range or exploitation status.
Unconfirmed: Affected versions, severity and exploitation status are not stated in the snippet.
- Zdenek Dohnal posted the report to oss-security on November 11.
- The cited advisory identifier is GHSA-wxj6-x3wg-4vmc.
- No fixed version number is stated in the mailing-list post.
Impact: Directory traversal via add-ppdfiles and delete-ppdfiles
| Product | Affected |
|---|---|
| OpenPrinting pappl-retrofit | — |
- 1.Watch for the forthcoming pappl-retrofit release that includes the fix.
- CVEs
- CVE-2026-123747
- Vendors
- OpenPrinting
- Products
- pappl-retrofit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123747 | Directory traversal in pappl-retrofit PPD upload and delete | 7.3 | — |
From the original article
Posted by Zdenek Dohnal on Nov 11 Hi all, https://github. com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc The fix will be included in the new release shortly after this announcement. Have a nice day, Zdenek Dohnal
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.