CVE-2026-34978

What it actually does

CVE-2026-34978 is a path traversal flaw in the OpenPrinting CUPS RSS notifier. A remote IPP client can supply a crafted notify-recipient-uri using ../ traversal, causing the notifier to write RSS XML outside the intended CacheDir/rss directory. Because the notifier runs with lp privileges and CUPS cache directories are commonly group-writable by lp, this can overwrite or corrupt files writable by that identity, including scheduler state such as job.cache. The practical impact is unauthorized file modification and denial of service or data loss for queued print jobs, rather than direct code execution.

Why it matters to the business

Affected CUPS print servers may lose queued print jobs, experience print service disruption, or have print scheduler state corrupted by an unauthenticated network client. This can interrupt business workflows that depend on centralized printing, especially in environments with shared Linux or Unix print infrastructure. The CVSS score is moderate and EPSS is currently low and flat, with no KEV listing or known ransomware use, but the issue is remotely reachable and no public patch was available at publication, so exposure should still be managed promptly through hardening and compensating controls.

How an attack unfolds

An attacker first identifies a reachable CUPS/IPP service running OpenPrinting CUPS 2.4.16 or earlier. The attacker then sends an IPP request that causes CUPS to invoke the RSS notifier with a malicious notify-recipient-uri containing path traversal sequences such as rss:///../job.cache. Instead of writing only under the RSS cache directory, the notifier resolves the path outside CacheDir/rss and writes attacker-controlled RSS XML bytes to a file writable by the lp user or lp group. If the target file is scheduler state such as CacheDir/job.cache, the next scheduler restart or reload can fail to parse the corrupted cache, causing previously queued jobs to disappear or the printing service to malfunction.

How to fix it

No fixed version was listed in the provided advisory data. When OpenPrinting publishes a patched CUPS release, upgrade all affected systems from CUPS 2.4.16 or earlier to the fixed version recommended by the vendor or distribution. Until patches are available, reduce exposure by restricting IPP/CUPS access to trusted networks and authenticated clients, blocking untrusted access to TCP 631, disabling or removing the RSS notifier if it is not required, and reviewing CUPS configuration to limit subscription and notification functionality. Also verify file permissions under the CUPS cache directory so only required files are writable by the lp identity, and ensure backups or job recovery procedures exist for print scheduler state.

How to confirm the fix worked

Confirm the installed CUPS package version is later than the vulnerable range once a vendor fix is available; otherwise treat CUPS 2.4.16 and earlier as potentially affected. Validate that remote, untrusted hosts cannot reach the IPP listener on TCP 631. Check whether the RSS notifier is installed or executable, typically under the CUPS notifier directory, and disable it if unused. Review CUPS configuration and access controls to ensure subscription and notification requests are restricted. After mitigation, attempt a controlled negative test using an IPP notification recipient URI containing ../ traversal and confirm it is rejected or cannot write outside CacheDir/rss. Inspect the CUPS cache directory to ensure job.cache and other scheduler state files are not unexpectedly XML-formatted, recently modified by lp outside normal operations, or corrupted.

Typical attack path

1. Scan for network-accessible CUPS or IPP services, commonly on TCP port 631.
2. Confirm the service is OpenPrinting CUPS 2.4.16 or earlier and accepts remote IPP client requests.
3. Submit an IPP operation that sets notify-recipient-uri to an rss:// URI containing ../ path traversal.
4. Cause the RSS notifier to write XML output outside the intended CacheDir/rss directory.
5. Overwrite or corrupt a file writable by the lp identity, such as CUPS cache or scheduler state.
6. Trigger or wait for cupsd restart, reload, or normal state parsing to produce print queue loss or service disruption.

How to detect it

Review CUPS access and error logs, commonly under /var/log/cups/, for IPP subscription or notification activity using rss:// recipient URIs that include ../ traversal. Look for unusual remote IPP requests preceding print queue loss, cupsd restart failures, or scheduler state parsing errors. Inspect CUPS cache locations, commonly /var/cache/cups/ and /var/cache/cups/rss/, for files outside the RSS directory that contain RSS/XML content or were modified by the lp user unexpectedly. Pay particular attention to job.cache corruption, sudden disappearance of queued jobs after cupsd restart, and filesystem events showing temp-file creation followed by rename into scheduler state files. If endpoint telemetry is available, search for execution of the RSS notifier process followed by writes outside the rss cache subdirectory.

• rss:///../
• notify-recipient-uri
• notify-recipient-uri=rss:///../
• /var/cache/cups/job.cache
• /var/cache/cups/rss/../
• /var/log/cups/error_log
• /var/log/cups/access_log
• /usr/lib/cups/notifier/rss
• /usr/libexec/cups/notifier/rss
• job.cache
• <?xml
• <rss
• Create-Printer-Subscription
• Create-Job-Subscription

What your security team should do

• Immediately inventory Linux and Unix print servers running OpenPrinting CUPS and identify versions 2.4.16 or earlier.
• Restrict network access to CUPS/IPP on TCP 631 to trusted administrative and client networks only.
• Disable or remove the CUPS RSS notifier where RSS notifications are not operationally required.
• Monitor CUPS logs for rss:// notification recipient URIs containing ../ traversal sequences.
• Check CUPS cache and state files for unexpected modification times, XML content, or parse failures.
• Prepare to apply vendor or distribution updates as soon as fixed CUPS packages are released.
• Back up CUPS scheduler state and document job queue recovery procedures for critical print services.