CVE-2026-34978: OpenPrinting CUPS Path Traversal Flaw

CVE-2026-34978 Overview

OpenPrinting CUPS, an open source printing system for Linux and other Unix-like operating systems, contains a path traversal vulnerability in the RSS notifier component. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss to anywhere that is lp-writable. Because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename() operations.

Critical Impact

Remote attackers can exploit this path traversal to clobber critical system files such as CacheDir/job.cache with RSS XML content. After restarting cupsd, the scheduler fails to parse the corrupted job cache, causing previously queued print jobs to disappear and disrupting print services.

Affected Products

• OpenPrinting CUPS versions 2.4.16 and prior
• Linux and Unix-like operating systems running vulnerable CUPS versions
• Systems with default CacheDir group-writable permissions (root:lp, mode 0770)

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-34978 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34978

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), allowing attackers to access files outside of a restricted directory. The RSS notifier component in CUPS fails to properly sanitize the notify-recipient-uri parameter, accepting directory traversal sequences that enable writing to arbitrary locations within the lp user's write permissions.

The attack exploits the default permission model where CacheDir is group-writable by the lp group. When the notifier processes a malicious URI like rss:///../job.cache, it follows the traversal path and writes RSS XML content to the targeted file. The use of temporary files combined with the rename() system call allows atomic replacement of root-managed state files.

Root Cause

The root cause stems from insufficient input validation in the RSS notifier's handling of the notify-recipient-uri parameter. The component fails to canonicalize and validate the path before performing file operations, allowing directory traversal sequences (..) to escape the intended CacheDir/rss directory. Combined with the default permission structure that grants the lp user/group write access to CacheDir, this creates an exploitable condition for file manipulation attacks.

Attack Vector

The attack is network-accessible, requiring no authentication or user interaction. An attacker can craft a malicious IPP request with a specially constructed notify-recipient-uri containing path traversal sequences. The vulnerability affects file integrity by allowing overwriting of critical system files, and impacts availability by corrupting the job cache, which prevents the CUPS scheduler from functioning correctly after a restart.

The proof-of-concept demonstrates clobbering CacheDir/job.cache with RSS XML content. When cupsd is subsequently restarted, it fails to parse the corrupted job cache, resulting in loss of all previously queued print jobs.

Detection Methods for CVE-2026-34978

Indicators of Compromise

• Unexpected modification timestamps on files within CUPS CacheDir directory
• Presence of RSS XML content in non-RSS files such as job.cache
• CUPS scheduler errors related to job cache parsing failures after service restart
• IPP requests containing notify-recipient-uri parameters with .. path sequences

Detection Strategies

• Monitor IPP traffic for requests containing notify-recipient-uri parameters with directory traversal patterns (../, ..%2f, etc.)
• Implement file integrity monitoring on critical CUPS state files including job.cache
• Configure CUPS logging to capture notification subscription requests at debug level
• Deploy network intrusion detection rules to identify malicious IPP request patterns

Monitoring Recommendations

• Enable verbose logging for the CUPS notifier subsystem to capture URI processing events
• Set up alerts for file modification events in CacheDir outside of normal CUPS operations
• Monitor for CUPS service restart failures accompanied by job cache parsing errors
• Track lp user file operations using audit logging to detect unauthorized writes

How to Mitigate CVE-2026-34978

Immediate Actions Required

• Restrict network access to the CUPS IPP service using firewall rules to trusted hosts only
• Review and restrict permissions on CacheDir to prevent group-write access where feasible
• Disable RSS notifications if not required by setting appropriate CUPS configuration options
• Implement network segmentation to limit exposure of printing services

Patch Information

At time of publication, there are no publicly available patches for this vulnerability. Organizations should monitor the GitHub Security Advisory for updates on patch availability. Until a patch is released, implementing the recommended workarounds is essential to reduce exposure.

Workarounds

• Disable the RSS notifier by removing or restricting access to the rss notifier binary in the CUPS notifier directory
• Modify CacheDir permissions to remove group-write access if operationally feasible
• Implement strict firewall rules to allow IPP connections only from trusted print clients
• Consider running CUPS in a containerized environment with restricted filesystem access

# Configuration example
# Restrict CUPS listening to localhost only (if remote printing not required)
# Edit /etc/cups/cupsd.conf
Listen localhost:631

# Remove group-write permission from CacheDir (may impact some operations)
chmod 0750 /var/cache/cups

# Block external IPP access at firewall level
iptables -A INPUT -p tcp --dport 631 -s ! 127.0.0.1 -j DROP