Vulnerability · critical · CVSS 9.6
pappl-retrofit directory traversal (CVE-2026-123747)
Tier D · Background noise – Good to know
Who’s exposed: Systems running pappl-retrofit with the affected add-ppdfiles and delete-ppdfiles actions
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
What to do
- Apply the fix from the commit linked in the oss-security announcement.
The Brief
- Zdenek Dohnal announced CVE-2026-123747 on the oss-security list on 2026-11-11.
- The flaw is a directory traversal in the add-ppdfiles and delete-ppdfiles actions of pappl-retrofit.
- The announcement rates it critical with a CVSS base score of 9.6, and links to a commit containing the fix.
Why it matters
Directory traversal in file-management actions can let an attacker reach files outside the intended directory on systems running pappl-retrofit. A fix is linked in the announcement.
The checklist behind the tier
Checklist · 0 of 10 yes
| No | Hits tech teams | Judgment: pappl-retrofit is niche printer-retrofit software, not developer tooling or widely run IT infrastructure. |
| No | Core infrastructure | Judgment: a single niche printer project, not core infrastructure like OpenSSH or the Linux kernel. |
| No | Popular tool | Judgment: pappl-retrofit is a niche project with limited adoption, not a widely used framework or tool. |
| No | Exploited in the wild | Open Source Security post announces the vulnerability; it reports no observed attacks or KEV listing. |
| No | Public exploit | Open Source Security post gives details and a commit link; it does not say exploit code or a PoC is published. |
| No | Remote, no login | Open Source Security post gives CVSS 9.6 but does not state that unauthenticated network access is enough. |
| No | Full takeover | Open Source Security post describes directory traversal; it does not state code execution or admin takeover. |
| No | Secrets exposed | Open Source Security post reports the flaw only; no stolen or exposed data is mentioned. |
| No | Supply chain | Open Source Security post describes a normal vulnerability in the project; no malicious code shipping is reported. |
| No | No fix yet | Open Source Security post links to the commit with the fix, so a fix is available. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Directory traversal vulnerability in pappl-retrofit disclosed on oss-security by Zdenek Dohnal
Open Source Security
CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions
Source
CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions ↗ Open Source Security · 1h ago
First seen · 1 source · Full story page · How tiers are decided