Security · High impactFan score 0 · Tier D
CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions
The Brief
- Zdenek Dohnal announced CVE-2026-123747 on the oss-security list on 2026-11-11.
- The flaw is a directory traversal in the add-ppdfiles and delete-ppdfiles actions of pappl-retrofit.
- The announcement rates it critical with a CVSS base score of 9.6, and links to a commit containing the fix.
Why it matters
Directory traversal in file-management actions can let an attacker reach files outside the intended directory on systems running pappl-retrofit. A fix is linked in the announcement.
Who’s affected
- pappl-retrofit users
What to do
- Apply the fix from the commit linked in the oss-security announcement.
- CVE-2026-123747
- #security
- #vulnerability
- #directory-traversal
- #pappl-retrofit
- #cve
Posted by Zdenek Dohnal on Nov 11 Hi all, I would like to announce the critical (CVSS 9.6) vulnerability in the project pappl-retrofit - the details and the link to the commit with fix are here…
Timeline
Directory traversal vulnerability in pappl-retrofit disclosed on oss-security by Zdenek Dohnal
Open Source Security
CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions