CVE-2026-34978: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-34978 is a path traversal vulnerability in the RSS notifier component of OpenPrinting CUPS that allows unauthenticated remote IPP clients to write arbitrary RSS XML data outside the intended CacheDir/rss directory. It affects OpenPrinting CUPS versions 2.4.16 and prior, and was published on April 3, 2026, with a fix released in version 2.4.17. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). In scheduler/ipp.c, the notify-recipient-uri subscription attribute is accepted from remote IPP clients without normalizing dot-segments (..) in the URI resource path. The httpSeparateURI() function in cups/http-support.c decodes and copies the resource without removing .. sequences, allowing a crafted URI such as rss:///../job.cache to escape the CacheDir/rss directory. The RSS notifier (notifier/rss.c) then constructs the output path by appending the unsanitized resource to CacheDir, writes to a temp file, and calls rename() — which, because CacheDir is group-writable by default (root:lp, mode 0770) with no sticky bit, allows the lp-running notifier to replace root-owned files in CacheDir (GitHub Advisory).

An unauthenticated remote attacker can overwrite any file in CacheDir that is writable by the lp user, including root-managed state files such as job.cache. Overwriting job.cache with malformed RSS XML causes the CUPS scheduler to fail parsing the job cache on restart, resulting in all previously queued print jobs disappearing — a direct availability impact. Additionally, repeated exploitation can flood CacheDir with attacker-created files, potentially exhausting disk space or inodes. There is no confidentiality impact, but integrity is compromised through persistent state file corruption (GitHub Advisory).

A detailed proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, including step-by-step bash scripts using ipptool with the crafted notify-recipient-uri value rss:///../job.cache. The exploit requires no authentication and no user interaction, targeting any CUPS deployment where untrusted clients can submit IPP requests and the RSS notifier is available (which is the default configuration). The EPSS score is approximately 0.058%, indicating low but non-zero probability of exploitation in the wild. There is no current evidence of in-the-wild exploitation, no CISA KEV listing, and no known threat actor attribution (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing or network-accessible CUPS instances running version 2.4.16 or earlier using tools like Shodan (searching for IPP port 631) or network scanners.
2. Submit a held print job: Use ipptool to send a Print-Job IPP request with job-hold-until=indefinite to a known printer URI (e.g., ipp://<target>:631/printers/p1), ensuring a job state file (c*) is created on disk.
3. Wait for job state flush: Wait approximately 30–50 seconds for cupsd to flush the dirty job state to disk (default flush interval is ~30 seconds).
4. Trigger path traversal via subscription: Send a Create-Printer-Subscription IPP request (or embed subscription attributes in a Print-Job request) with notify-recipient-uri set to rss:///../job.cache and notify-events set to printer-state-changed.
5. File overwrite occurs: The RSS notifier writes RSS XML to a temp file and calls rename() targeting CacheDir/job.cache (outside CacheDir/rss), overwriting the root-managed state file with attacker-controlled XML content.
6. Trigger functional impact: Restart cupsd (or wait for a natural restart). The scheduler attempts to parse job.cache, encounters RSS XML instead of valid directives, logs Missing directive errors, and drops all previously queued jobs from the queue (GitHub Advisory).

• Network: Unexpected IPP Create-Printer-Subscription or Print-Job requests from untrusted or external hosts containing notify-recipient-uri values with .. sequences (e.g., rss:///../job.cache); unusual volume of IPP subscription requests on port 631.
• File System: Presence of XML files (RSS format) in CacheDir outside the CacheDir/rss subdirectory; job.cache file owned by lp:lp instead of root:lp, or containing XML content rather than CUPS directive format; unexpected files named vh-flood-*.xml or similar in CacheDir.
• Logs: CUPS error log (/var/log/cups/error_log) entries such as Missing directive on line N of .../job.cache after a restart; Loading job cache file followed immediately by multiple Missing directive errors; sudden disappearance of all queued jobs after a cupsd restart.
• Process: The cups-rss notifier process writing to paths outside CacheDir/rss; rename() syscall activity from the lp user targeting files in CacheDir directly (GitHub Advisory).

The vulnerability is fixed in OpenPrinting CUPS version 2.4.17, which normalizes dot-segments in the RSS notifier path construction (commits af366b1 on master and 730347c on the 2.4.x branch). Administrators should upgrade to CUPS 2.4.17 or later as the primary remediation. As interim workarounds: restrict network access to the CUPS IPP service (port 631) using firewall rules to allow only trusted hosts; and consider tightening CacheDir permissions to remove group-write access for the lp group, though this may affect CUPS functionality. Distribution-specific patches are available for SUSE, Ubuntu (USN-8405-1), Amazon Linux 2, Amazon Linux 2023, Slackware, and Fedora (GitHub Advisory, OpenPrinting Release, Ubuntu Advisory).

The vulnerability was reported by researcher manizada and fixed by CUPS maintainer Mike Sweet (michaelrsweet) at the time of advisory publication. The fix was committed to both the master and 2.4.x branches simultaneously with the advisory disclosure on March 31, 2026. The oss-security mailing list carried a disclosure post, and multiple Linux distributions (SUSE, Ubuntu, Fedora, Amazon Linux, Slackware, openSUSE) issued security advisories and updated packages within weeks of disclosure (oss-security, GitHub Advisory).