Preliminary research

Spooler Alert: Remote Unauthenticated RCE-to-root Chain in CUPS

Asim Viladi Oglu Manizada · Hey, it's Asim · 5 April 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.

Builds a remote CUPS chain from newline-preserving option serialization: an attacker injects a trusted PPD control record that the scheduler later interprets as configuration. A separate localhost authorization-token leak and temporary-printer race convert the primitive into root-controlled file overwrite and command execution.

Record

Researcher

Asim Viladi Oglu Manizada

Published by

Hey, it's Asim

Date

5 April 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• command-injection
• race-condition
• auth-bypass
• file-write
• privilege-escalation
• linux
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Asim Viladi Oglu Manizada, first published at the original source. Preserved copies are kept so the citation survives its host.