CVE-2026-34978 Path traversal in cups
Remote attackers can exploit path traversal in CUPS RSS notifier to write files outside the cache directory, potentially corrupting job state and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34978?
CVE-2026-34978 is a medium-severity path traversal vulnerability in OpenPrinting cups, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches.
Weakness: CWE-22
Which versions are affected by CVE-2026-34978?
It affects 1 product.
Products include Openprinting Cups.
How do I fix CVE-2026-34978?
No fix published yet.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-34978 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34978 exists.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
- CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)
Sources
Also known as ALPINE-CVE-2026-34978, AZL-81819, BELL-CVE-2026-34978, DEBIAN-CVE-2026-34978, ECHO-6ed2-4f33-7d2a, GHSA-f53q-7mxp-9gcr and 3 more.