OpenPrinting CUPS (<= 2.4.16) contains a CWE-22 path traversal vulnerability in the RSS notifier component. The notify-recipient-uri parameter can be manipulated with '..' sequences to write arbitrary RSS XML bytes outside the restricted CacheDir/rss directory, specifically to any location writable by the lp user group. Because CacheDir is group-writable (typically root:lp with mode 0770), the notifier process running as lp can overwrite root-managed state files using a temporary file and rename operation. A proof-of-concept demonstrates overwriting CacheDir/job.cache, which causes the scheduler to fail parsing the job cache after a cupsd restart, leading to loss of previously queued jobs. No patches or vendor advisories indicating remediation are currently available.

This vulnerability allows an unauthenticated remote attacker to perform path traversal and write arbitrary RSS XML data to critical state files within the CUPS CacheDir. The immediate impact is the corruption of the job cache file, causing the print scheduler to fail and queued print jobs to disappear. This results in denial of service for printing operations. There is no indication of confidentiality or integrity compromise beyond the job cache manipulation. No known exploits in the wild have been reported.

At the time of this report, no official patches or fixes are available. Users should monitor the OpenPrinting project for updates and advisories. As a temporary mitigation, restricting network access to the IPP service to trusted clients only may reduce exposure. Avoid restarting cupsd until a fix is applied to prevent loss of queued jobs. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.