The vulnerability resides in the copy_banner function of OpenPrinting CUPS prior to version 2.4.20. It allows an attacker to supply a specially crafted IPP attribute, natural-language, that includes path separators and a chosen banner name. Because the system resolves the attribute as a directory component beneath DataDir/banners, an attacker can manipulate the path so that the root scheduler opens a file outside the banner directory. The bytes of that file are then copied into a job-sheet spool object that a backend can deliver to an attacker‑observable endpoint. This results in the disclosure of arbitrary files readable by the scheduler process, potentially exposing sensitive system data. The weakness is a classic directory traversal flaw, identified as CWE‑22.

OpenPrinting CUPS is affected any release prior to version 2.4.20. Variants of the CUPS scheduler that process job‑sheet banners are susceptible if the scheduler is configured to use the copy_banner function and the backend can deliver the resulting job‑sheet to an endpoint controlled by an attacker.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further reducing immediate threat perception. An attacker must control IPP job submissions, have the ability to create or influence symlinks or files beneath DataDir/banners, and rely on the backend delivering the job‑sheet. Given these prerequisites and the low EPSS, exploitation is possible but requires a sophisticated operational context. The recommended response is to apply the official fix found in CUPS 2.4.20.