A critical path traversal flaw in OpenPrinting pappl-retrofit lets remote attackers upload or delete any file on a Linux system as root, and proof-of-concept exploit code is now public. Tracked as CVE-2026-123747, the bug affects pappl-retrofit versions 1.0b2 and older, and developers have already shipped a fix.

Two dots to root

The flaw stems from missing file name checks (CWE-22) on the tool's /addppd page, which handles printer driver uploads. When a user uploads or deletes a driver file, the application joins the supplied name straight onto the base folder path without checking it. As the researchers put it, triggering the flaw takes only adding ../ to the file name.

That lets an attacker write or delete files in any folder on the system as root. Attackers can also upload a rogue driver containing a cupsFilter rule and print a test page to run commands as root. The risk is sharpened by the service itself: pappl-retrofit adapts old CUPS printer drivers for modern Linux systems such as Ubuntu, and its legacy-printer-app service runs as root with no login check, listening on port 8000 by default.

Fix available, no attacks confirmed

Researchers Danilo Egea Gondolfo, Jorge Castro and 7A Security reported the flaw. Developers fixed it in master commit c65a28f, which blocks driver names that escape the upload folder. No active exploitation has been confirmed, but with working proof-of-concept commands public, unpatched hosts face high risk.

The flaw is scored 9.6 critical, although the score falls to 7.3 on RHEL 10, CentOS Stream 10 and Fedora, where a packaging bug leaves out the target folder by default. Linux administrators should update to a build containing commit c65a28f at once, or stop the legacy-printer-app service and block TCP port 8000 until they can. Security Online reported the disclosure and the fix.