7.3Hoch

CVE-2026-123747Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions

OpenPrinting pappl-retrofit; Red Hat Red Hat Enterprise Linux 10 Veröffentlicht: 2026-11-11 21:31 (vor 1 Stunde)

Beschreibung

A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.

Schwachstellentyp (CWE): CWE-22

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
OpenPrinting	pappl-retrofit	≤ 1.0b2
Red Hat	Red Hat Enterprise Linux 10	—

Referenzen und Patches

https://access.redhat.com/security/cve/CVE-2026-123747 vdb-entry
RHBZ#2568110 issue-tracking

CVSS-Score

7.3Hoch

Quelle: redhat · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Hoch
Rechte erforderlich: Hoch
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Keine
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H

Zeitverlauf

ID reserviert2026-11-06
Veröffentlicht2026-11-11 21:31
Bei IP-DB eingegangen2026-11-11 22:03
Zuletzt aktualisiert2026-11-11 21:31

Vergeben von (CNA): redhat

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

7.8Hoch

CVE-2026-108472 vor 58 Minuten

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…

7.5Hoch

CVE-2026-91150 vor 58 Minuten

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…

5.5Mittel

CVE-2026-124746 vor 4 Stunden

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attache…

6.3Mittel

CVE-2026-124745 vor 7 Stunden

Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links t…

6.3Mittel

CVE-2026-124744 vor 7 Stunden

Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can crea…

7.6Hoch

CVE-2026-124741 vor 8 Stunden

Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, tr…