CVE-2026-34978 OpenPrinting CVE debrief

Who should care

System administrators and users of OpenPrinting CUPS, especially those with lp-writable permissions, should be aware of this vulnerability. They should review and restrict access to lp-writable directories and files, implement additional monitoring for suspicious activity in CUPS logs, and consider applying compensating controls, such as restricting IPP client access.

Technical summary

The RSS notifier in OpenPrinting CUPS allows .. path traversal in notify-recipient-uri, enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss. This can lead to replacing root-managed state files, potentially causing issues like the scheduler failing to parse the job cache and previously queued jobs disappearing. The vulnerability affects versions 2.4.16 and prior of OpenPrinting CUPS.

Defensive priority

Medium priority due to the potential for data loss and system disruption.

Recommended defensive actions

• Review and restrict access to lp-writable directories and files.
• Implement additional monitoring for suspicious activity in CUPS logs.
• Consider applying compensating controls, such as restricting IPP client access.
• Verify and apply vendor patches when available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. The vendor advisory on GitHub offers mitigation guidance. Affected product deployments should be reviewed for exposure, and owners assigned for follow-up. The vulnerability allows remote IPP clients to write RSS XML bytes outside CacheDir/rss, potentially replacing root-managed state files. Defenders should verify affected scope, severity, and vendor guidance. Additional review of relevant monitoring, detection, and logs for exposed assets is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.