CVE-2026-55480: CWE-59: Improper Link Resolution Before File Access ('Link Following') in OpenPrinting cups

OpenPrinting CUPS versions before 2.4.20 contain a vulnerability in the copy_model() function located in scheduler/ipp.c. This function creates a temporary file path based on a connection number inside an lp-group-writable directory and opens it as root without using O_EXCL or O_NOFOLLOW flags. An attacker with write access to the lp group directory can predict the temporary file name and create a symbolic link to a root-writable file before the root process opens it. When a privileged add-printer or modify-printer operation triggers copy_model(), the root scheduler follows the symlink and overwrites the target file with generated PPD data. This leads to compromised file integrity or availability. Exploitation requires a foothold with lp group write permissions and a privileged operation to trigger the vulnerability. The vulnerability is addressed in OpenPrinting CUPS version 2.4.20.

Successful exploitation allows an attacker with lp group write access and the ability to trigger privileged printer administration operations to overwrite or truncate arbitrary root-writable files. This compromises file integrity and availability, potentially impacting system stability or security. There is no confidentiality impact reported. The CVSS 3.1 base score is 5.7 (medium severity), reflecting the requirement for high privileges and local access.

This vulnerability is fixed in OpenPrinting CUPS version 2.4.20. Users and administrators should upgrade to version 2.4.20 or later to remediate this issue. Until upgraded, restrict write permissions to the lp group directory and limit access to privileged printer administration operations to trusted users only.