CVE-2026-61702

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions prior to 2.4.20

Description In the copy banner() function within scheduler/ipp.c, the system improperly handles the attributes-natural-language value provided by a user when processing a job-sheets banner. An attacker can use path separators in the language value to escape the intended banner directory. If the traversed path contains a matching reachable basename and the scheduler has sufficient filesystem and sandbox access, the root scheduler may open a reachable file and copy its contents into a job-sheet spool object, which can then be delivered to an attacker-observable endpoint.

Recommendations Update to version 2.4.20.