Red Hat CVE-2026-34978

OpenPrinting CUPS is a standards-compliant printing system built on the Internet Printing Protocol (IPP). The vulnerability resides in the RSS notifier component, which processes the notify-recipient-uri parameter submitted by remote IPP clients. The root cause (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) stems from insufficient path validation in the notifier's handling of this parameter. The notifier runs under the 'lp' user account with file permissions inherited from CUPS' CacheDir (typically root:lp with mode 0770, group-writable). By injecting '../' sequences into the notify-recipient-uri (e.g., 'rss:///../job.cache'), an attacker can escape the intended rss subdirectory and write files to the parent CacheDir or other lp-accessible locations. The attacker can leverage atomic file operations (temp-file creation followed by rename) to overwrite existing files such as job.cache, which the CUPS scheduler (cupsd) parses on startup. Corruption of job.cache causes the scheduler to fail parsing and lose all queued jobs.