Description

A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend. A local user who is a member of the lpadmin group can configure a printer that uses a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, so the root-privileged backend can write attacker-controlled print data to an arbitrary file. This can be used to change security-sensitive CUPS configuration and ultimately achieve root code execution. Exploitation requires local lpadmin group membership and a serial backend binary installed with root-only permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-22T09:17:06.217Z",
  "pubdate": "2026-09-22T09:17:06.217Z",
  "executiveSummary": "A privilege escalation vulnerability exists in the CUPS printing system, specifically within the cups-filters serial backend. This flaw allows a local attacker, authenticated as a member of the lpadmin group, to achieve arbitrary file writes with root privileges.\nThe vulnerability stems from the CUPS scheduler's failure to validate and restrict the path components of non-file device URIs. By crafting a malicious printer configuration that leverages a privileged serial backend, an attacker can redirect print data to sensitive system files.\nThe successful exploitation of this vulnerability permits the modification of security-critical CUPS configuration files, which can be leveraged to achieve arbitrary code execution as the root user. This represents a significant security risk, as it elevates a low-privilege administrative user to full system compromise.\nExploitation requires the attacker to possess lpadmin group membership and assumes the existence of a serial backend binary configured with root-level file system permissions. Because the attack occurs locally via the CUPS management interface, it does not require network exposure, though it relies on the internal trust model of the CUPS scheduler process.",
  "technicalDetails": "The vulnerability is rooted in an insufficient validation mechanism within the CUPS scheduler when handling device URIs for the cups-filters serial backend. In the CUPS architecture, the scheduler acts as a broker for print jobs, often executing backend binaries with elevated root privileges to interact with hardware interfaces.\nThe core issue is a lack of path sanitization regarding non-file device URIs. When a user with lpadmin privileges defines a new printer, they can specify a device URI that points to an arbitrary location on the filesystem rather than a legitimate serial port device. Because the CUPS scheduler does not perform strict path validation or scoping, it fails to constrain the backend's output stream to appropriate device directories.\nThe attack flow proceeds as follows: First, the attacker, holding lpadmin group membership, utilizes the CUPS administrative interface or command-line utilities to configure a new printer queue. During the printer setup, the attacker provides a maliciously crafted device URI that references a target file instead of a hardware device. When a print job is submitted to this queue, the CUPS scheduler executes the serial backend binary with root privileges.\nUpon execution, the backend binary opens the path specified in the malicious URI. Since the backend runs with root privileges, the file system enforces no restrictions on the write operation. The print job data, which is fully attacker-controlled, is then written directly to the target file. By targeting configuration files critical to CUPS operation (such as cupsd.conf or associated policy files), the attacker can modify the CUPS environment to execute arbitrary commands or grant further unauthorized access.\nThis vulnerability effectively transforms a legitimate printing configuration step into a root-level arbitrary file write primitive. The post-exploitation impact is catastrophic, as the attacker can manipulate system configuration files to execute payloads with root authority. The requirement for lpadmin membership represents a standard administrative boundary that is bypassed through the exploitation of the backend's trusted execution state, allowing the attacker to escape the restricted printer management context."
}