# CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/658) · 2026-11-11 · Security
Page: https://themorning.dev/story/cve-2026-123747-pappl-retrofit-directory-traversal-in-the-add-ppdfiles-and-delet-be3dc30be8fabe2e
Kind: security · Impact: high

## In brief

- Zdenek Dohnal announced CVE-2026-123747 on the oss-security list on 2026-11-11.
- The flaw is a directory traversal in the add-ppdfiles and delete-ppdfiles actions of pappl-retrofit.
- The announcement rates it critical with a CVSS base score of 9.6, and links to a commit containing the fix.

## Why it matters

Directory traversal in file-management actions can let an attacker reach files outside the intended directory on systems running pappl-retrofit. A fix is linked in the announcement.

## What to do

- Apply the fix from the commit linked in the oss-security announcement.

## CVEs

- CVE-2026-123747

## Timeline

- 2026-11-11: Directory traversal vulnerability in pappl-retrofit disclosed on oss-security by Zdenek Dohnal

## Coverage

- [CVE-2026-123747 pappl-retrofit: Directory traversal in the add-ppdfiles and delete-ppdfiles actions](https://seclists.org/oss-sec/2026/q4/658) — Open Source Security, 2026-11-11

Tags: security, vulnerability, directory-traversal, pappl-retrofit, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev