CVE-2026-123747

Name of the Vulnerable Software and Affected Versions pappl-retrofit (affected versions not specified)

Description An issue exists where the application does not properly sanitize user-supplied filenames during the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can use path traversal sequences—special characters used to access files and directories outside the intended folder—to upload or delete arbitrary files on the system. This can lead to data corruption, denial of service, or arbitrary command execution.

Recommendations Apply commit c65a28f.