CVE-2026-61702 OpenPrinting CUPS: root-side banner file disclosure
Attackers can exploit path traversal in CUPS banner processing to read arbitrary files via job sheets, requiring specific pre-positioned filesystem state.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61702?
CVE-2026-61702 is a medium-severity path traversal vulnerability in OpenPrinting cups, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.
Weakness: CWE-22
Which versions are affected by CVE-2026-61702?
It affects 1 product.
Products include Openprinting Cups.
How do I fix CVE-2026-61702?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-61702 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61702 exists.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2026-34978 Path traversal in cups
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
Sources
Also known as AZL-108281, BELL-CVE-2026-61702, DEBIAN-CVE-2026-61702, ECHO-d1e3-6268-da43, GHSA-gq9p-4w7m-2f5g, UBUNTU-CVE-2026-61702.