CVE-2026-55480

A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying whether the file is a symbolic link (symlink). By creating a symlink targeting a sensitive file before the service opens it, an attacker can cause the privileged service to truncate or overwrite that file, leading to data corruption, service disruption, or privilege escalation.

A symlink following flaw in CUPS's copy_model() function allows a local user with lp group or print administration privileges to overwrite arbitrary root-writable files via a predictable temporary file race condition during printer addition or modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict access to the lp administrative group and ensure the CUPS TempDir points to a private directory with restricted permissions (0700) owned strictly by root.