This vulnerability, tracked as CVE-2026-91099, concerns improper handling of symbolic links within HPLIP, which could be exploited to follow symlinks in an unsafe manner. It is one of several externally reported vulnerabilities HP addressed in HPLIP. The affected versions are all releases before 3.26.6. The CVSS 4.0 base score is 5.1, indicating medium severity, with attack vector local, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation could allow an attacker with local access to cause unauthorized file modifications, potentially leading to privilege escalation, denial of service, or information disclosure. The vulnerability does not require user interaction or privileges, but the attack vector is local, limiting remote exploitation. No known exploits are reported in the wild at this time.

HP has remediated this vulnerability in version 3.26.6 of HPLIP. Users should upgrade to version 3.26.6 or later to address this and related vulnerabilities. No cloud service is involved, so local patching is required. Patch status is confirmed by the vendor's advisory indicating remediation in 3.26.6.