OpenPrinting CUPS versions 2.4.16 and earlier contain a path traversal vulnerability in the RSS notifier’s notify‑recipient‑uri handling. A malicious remote IPP client can submit a URI such as rss:///../job.cache, causing the notifier process, which runs as the lp user, to write arbitrary RSS XML data outside the intended CacheDir/rss directory and overwrite the job.cache file. The replacement of job.cache corrupts the internal job cache and, after a cupsd restart, the scheduler fails to parse it, causing all queued jobs to disappear. This flaw allows an attacker to disrupt printing services without local user privileges, resulting in a denial of service to printers and the loss of queued print jobs.

All installations of OpenPrinting CUPS 2.4.16 or earlier that have RSS notifications enabled and utilize the default CacheDir permissions (group‑writable by root:lp, mode 0770) are vulnerable. This includes Linux and other Unix-like operating systems that ship CUPS within that version range.

The CVSS base score of 6.5 indicates moderate severity, and although no EPSS score is provided, the vulnerability is exploitable via the network from a remote IPP client without requiring local privileges. The CVE is not listed in CISA’s KEV catalog. The attacker requires only the ability to send an IPP request to the printer service on port 631, which many public-facing printers may expose.