{"schema":"threatline.record/2","record":{"id":"CVE-2026-105326","aliases":["GHSA-r4wf-366f-f6g3"],"summary":"Cups: cups: argument injection in mailto notifier via notify-recipient-uri","details":"An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.","categories":["Operating systems"],"product":"Red Hat Hardened Images","vendor":"Red Hat","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105326","source_modified_at":"2026-10-07T17:20:06.153Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.4.19-4.3.hum1","versionType":"rpm"}],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105326","source_modified_at":"2026-10-07T17:20:06.153Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105326","source_modified_at":"2026-10-07T17:20:06.153Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105326","source_modified_at":"2026-10-07T17:20:06.153Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105326","source_modified_at":"2026-10-07T17:20:06.153Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3","source_modified_at":"2026-10-05T13:49:27Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"name":"Red Hat Hardened Images","ecosystem":null},"range":"2.4.7"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3","source_modified_at":"2026-10-05T13:49:27Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"name":"Red Hat Hardened Images","ecosystem":null},"version":"2.4.20"}],"cvss":2.5,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00217,"percentile":0.11497,"score_date":"2026-10-23"},"published_at":"2026-10-05T18:58:56.161Z","modified_at":"2026-10-07T17:20:06.153Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105326","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T17:20:06.153Z"},{"source":"GitHub Advisory Database","url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3","fetched_at":"2026-10-23T18:58:35.272684Z","source_modified_at":"2026-10-05T13:49:27Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105326","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:77638","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-105326","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545835","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://github.com/OpenPrinting/cups/commit/1244ed9"},{"source":"CVE List","url":"https://github.com/OpenPrinting/cups/commit/611d1bd"},{"source":"CVE List","url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T14:43:04.210560Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T17:20:06.153Z","content_hash":"7fef7741f626195ddf7989ced1967920347ba01b36bfffa81b7bdef079270103"}}