oss-security - CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <ec10303c-77c4-4ac6-b1c2-b8579d2464e1@redhat.com>
Date: Wed, 11 Nov 2026 15:02:19 +0100
From: Zdenek Dohnal <zdohnal@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-123747 pappl-retrofit: Directory traversal in the
 add-ppdfiles and delete-ppdfiles actions

Hi all,

I would like to announce the critical (CVSS 9.6) vulnerability in the 
project pappl-retrofit - the details and the link to the commit with fix 
are here:

https://github.com/OpenPrinting/pappl-retrofit/security/advisories/GHSA-wxj6-x3wg-4vmc

The fix will be included in the new release shortly after this announcement.


Have a nice day,


Zdenek Dohnal

-- 
Zdenek Dohnal
Senior Software Engineer
Red Hat, BRQ-TPBC

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.