---
id: CVE-2026-34978
title: >-
  OpenPrinting CUPS is an open source printing system for Linux and other
  Unix-like operating systems
summary: >-
  OpenPrinting CUPS is an open source printing system for Linux and other
  Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier
  allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache),
  letting a r…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-22
vendor: openprinting
product: cups
affected:
  - cups <= 2.4.16
published: '2026-04-03'
updated: '2026-07-20'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34978'
references:
  - url: >-
      https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr
    label: security-advisories@github.com
  - url: >-
      https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0042
epssPercentile: 0.33652
ingestedAt: '2026-07-21T16:51:40.741Z'
---

## Overview

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches.

## Affected

- `cups <= 2.4.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.