# CVE-2026-61702: OpenPrinting CUPS path traversal in banner processing

Source: https://junglewise.ai/threats/cve-2026-61702-openprinting-cups-is-an-open-source-printing-system-for-linux-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-61702 · Severity: medium · CVSS 5.3 · Published 2026-10-15

CUPS is a printing system that manages print jobs and manages access to printers on Unix-like systems. A flaw in banner processing allows an attacker to read arbitrary files from the system by crafting malicious print job attributes, potentially exposing sensitive data. The vulnerability requires the attacker to submit a specially crafted print job and relies on existing file state such as symlinks, limiting but not eliminating real-world impact.

Technologies: [OpenPrinting Cups](https://junglewise.ai/threats/technologies/cups). Vendors: [OpenPrinting](https://junglewise.ai/threats/vendors/openprinting).

## Quick answers

**Is CVE-2026-61702 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61702 being exploited in the wild.

**How severe is CVE-2026-61702?** Medium severity, with a CVSS score of 5.3, published 15 October 2026.

**Which products and versions are affected?** OpenPrinting Cups before 2.4.20.

**Is there a fix for CVE-2026-61702?** Yes: fixed in 2.4.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61702 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-61702?** Check whether you run OpenPrinting Cups at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.4.20

## Technical details

A path traversal vulnerability exists in the copy_banner() function in scheduler/ipp.c prior to version 2.4.20, where the attacker-controlled IPP attributes-natural-language value is unsanitized and used as a directory component beneath DataDir/banners. By injecting path separators, an attacker can traverse to arbitrary files on the system that the CUPS scheduler can access. Successful exploitation requires the job-sheets value to match a registered banner basename and pre-positioned path state such as symlinks, but allows file contents to be copied into a spool object and delivered to an attacker-observable endpoint.

## Affected products

- OpenPrinting CUPS before 2.4.20

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3](https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3)
- [https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2](https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2)

## Related threats

- [OpenPrinting CUPS symlink-based file truncation in scheduler](https://junglewise.ai/threats/cve-2026-55480-openprinting-cups-is-an-open-source-printing-system-for-linux-and)
- [CUPS null pointer dereference in IPP job ticket handling](https://junglewise.ai/threats/cve-2026-107655-a-flaw-was-found-in-cups-when-processing-embedded-job-ticket)
- [OpenPrinting CUPS NULL pointer dereference in cupsdCheckJobs](https://junglewise.ai/threats/cve-2026-107888-openprinting-cups-before-2-4-20-contains-a-null-pointer)
- [CUPS scheduler case-insensitive username comparison in ACL validation](https://junglewise.ai/threats/cve-2026-87876-cups-scheduler-case-insensitive-username-comparison-in-acl)
- [OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17…](https://junglewise.ai/threats/cve-2026-41079-openprinting-cups-is-an-open-source-printing-system-for-linux-and)