CVE-2026-61702: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in OpenPrinting cups

OpenPrinting CUPS versions before 2.4.20 contain a path traversal vulnerability in the copy_banner() function within scheduler/ipp.c. The vulnerability arises because the function uses the attacker-controlled IPP attributes-natural-language value as a directory component under DataDir/banners without sufficient restriction. Although the job-sheets value must match a registered banner basename and the traversed path must contain a matching reachable basename, an attacker can exploit pre-positioned filesystem state such as symlinks to escape the banner directory. This allows reading arbitrary files accessible to the scheduler's filesystem and sandbox, copying their contents into a job-sheet spool object that a configured backend may deliver to an endpoint observable by the attacker. The issue is resolved in version 2.4.20.

An attacker can read arbitrary files accessible to the scheduler by exploiting path traversal via crafted IPP attributes. This leads to information disclosure of file contents through job-sheet spool objects. There is no indication of integrity or availability impact. The vulnerability requires no privileges or user interaction and has a network attack vector.

This vulnerability is fixed in OpenPrinting CUPS version 2.4.20. Users should upgrade to version 2.4.20 or later to remediate this issue. No other mitigation or workaround is indicated by the vendor advisory.