{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "2.4.20"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "ef80eeaea51430a055948240eea3f28ef5354edf"
            }
          ],
          "repo": "https://github.com/openprinting/cups",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-69qc-prxg-h2c7"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-150",
      "CWE-93",
      "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55467.json"
  },
  "details": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.",
  "id": "CVE-2026-55467",
  "modified": "2026-10-16T02:30:41.869634889Z",
  "published": "2026-10-15T17:08:24.374Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55467.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681"
    },
    {
      "type": "FIX",
      "url": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55467"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)"
}