CVE-2026-123747

A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.

• CWE-22

• https://access.redhat.com/security/cve/CVE-2026-123747
• https://bugzilla.redhat.com/show_bug.cgi?id=2568110
• https://www.openwall.com/lists/oss-security/2026/11/11/9

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123705The Security For WooCommerce WordPress plugin through 1.0.16…5.3
• CVE-2026-123710A flaw was found in Red Hat Quay. An unauthenticated client …9.8
• CVE-2026-123717OS command injection in the pass and bitwarden credential pr…8.8
• CVE-2026-12372A Server-Side Request Forgery (SSRF) vulnerability exists in…3.7
• CVE-2026-12374Improper certificate validation and a time-of-check time-of-…6.4
• CVE-2026-123746The Symfony Security HTTP component AuthenticatorManager::au…2.3
• CVE-2026-123748A security flaw has been discovered in chenyme grok2api up t…4.3
• CVE-2026-12375The uncanny-automator-pro WordPress plugin before 7.3.0.6 wa…9.8
• CVE-2026-123751The WP Duplicate WordPress plugin through 1.1.11 does not p…9.8
• CVE-2026-123753Server-Side Request Forgery (SSRF) vulnerability in Apache A…9.1
• CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
• CVE-2026-123765Improper neutralization of input during web page generation …