High priorityDisclosed

Advisory · CVE-2026-95511

CUPS serial backend flaw lets lpadmin users reach root

A privilege escalation flaw in CUPS with the cups-filters serial backend lets a local user in the lpadmin group point a printer's device URI at an arbitrary path, so the root-privileged backend writes attacker-controlled data to any file. A public proof of concept exists.

Advisory published September 22, 2026Independent summary
Vendor
OpenPrinting
Product
CUPS
Identifier / CWE
CVE-2026-95511
CWE-269
Action timing
Immediate
ELI5

Explain it like I’m five

The office printer manager hands visitor forms to a security guard with a master key. The guard is supposed to deliver them only to the mailroom, but nobody checks the address on the form. A visitor writes a different address, the guard opens any door in the building, and the visitor walks in.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01lpadmin member

    A local user who is a member of the lpadmin group configures a new printer that uses the privileged serial backend.

  2. 02Unrestricted device URI

    The CUPS scheduler does not restrict the path component of non-file device URIs, so the user supplies an arbitrary file path.

  3. 03Root-privileged write

    The backend binary runs with root-only permissions and writes attacker-controlled print data to the chosen path.

  4. 04Root code execution

    Writing to security-sensitive CUPS configuration files lets the attacker escalate to full root code execution.

What happened

Red Hat disclosed a privilege escalation vulnerability in CUPS when used with the cups-filters serial backend, rated high at CVSS 8.2. A public proof of concept demonstrating root escalation is available.

The CUPS scheduler does not restrict the path component of non-file device URIs. A local user who is a member of the lpadmin group can therefore configure a printer that uses a privileged serial backend and point its device URI at an arbitrary file path. Because the backend binary runs with root-only permissions, attacker-controlled print data gets written to any file on the system. That can be used to rewrite security-sensitive CUPS configuration and ultimately reach root code execution.

Exploitation requires local access with lpadmin group membership plus a serial backend binary installed with root-only permissions, which narrows the exposed population, but the published proof of concept makes the path reproducible for anyone who meets those conditions.

What to do

  1. Apply the fixed cups-filters and cups packages from your distribution. Red Hat ships fixes through errata linked from its CVE page; other distributions will carry their own updated packages.
  2. Audit lpadmin group membership and remove users who no longer need printer administration rights.
  3. Review CUPS configuration and log files for unfamiliar printers, device URIs with unexpected paths, or modified configuration.
  4. On systems where printing is not needed, disable or remove the CUPS service to shrink the attack surface.
  5. Verify the installed package versions against the vendor errata after updating.

Management note

Local root escalation in a component installed by default on most Linux desktops and servers is easy to underestimate because it needs a foothold first. But with a public proof of concept in circulation, every compromised low-privilege account becomes a root compromise waiting to happen. Patch the print stack like any other privilege boundary.