CVE-2026-4480-PoC

CVE-2026-4480 – Samba Print Job Name Command Injection

Overview

CVE-2026-4480 is a command injection vulnerability affecting certain Samba printing configurations that use external print commands.

The vulnerability exists because Samba inserts user-controlled print job metadata into a shell command without properly escaping shell metacharacters. Under specific configurations, an attacker can supply a malicious print job name that causes arbitrary commands to execute on the server.

The issue is particularly dangerous because some printer shares permit guest access, allowing exploitation without authentication.

Root Cause

Samba supports several printing backends. One legacy option, commonly referred to as sysv-style printing, executes an external command whenever a print job completes.

Administrators can configure commands using substitution macros such as:

print command = /usr/local/bin/print-helper %s %J

Where:

• %s → Path to the spool file
• %J → Print job name supplied by the client

Prior to the fix, the %J value underwent minimal sanitization before being inserted into a command executed through the system shell.

Because shell metacharacters remained intact, specially crafted job names could alter the intended command flow and execute attacker-controlled instructions.

Attack Flow

A typical attack consists of four stages:

1. Discover a printer share that allows guest printing.
2. Connect to the printer share using SMB.
3. Submit a print job containing a malicious job name.
4. Wait for Samba to invoke the configured print command.

If the print command references %J, the attacker's payload becomes part of the shell command and executes with the permissions of the Samba printing process.

Why Configuration Matters

Not every Samba installation is vulnerable.

The following conditions must generally be true:

• Samba is configured with a printing backend that executes external shell commands.
• The print command references %J.
• A printer share is accessible to the attacker.
• Guest printing or weak authentication permits job submission.

Modern deployments using CUPS-based printing do not expose this attack path because jobs are passed through the CUPS API instead of a shell command.

Impact

Successful exploitation may allow an attacker to:

• Execute arbitrary operating system commands
• Obtain a shell under the Samba service account
• Access files available to the print subsystem
• Pivot to additional privilege escalation opportunities
• Move laterally within an environment

The severity depends heavily on the permissions of the printing process and the surrounding system configuration.

Vulnerable Versions

Affected releases include versions prior to:

• 4.22.10
• 4.23.8
• 4.24.3

Systems using later releases are not affected by this issue.

Mitigation

Recommended mitigations include:

1. Upgrade Samba to a patched version.
2. Remove %J from print commands if it is not required.
3. Quote user-controlled macros before passing them to shell commands.
4. Migrate to printing = cups where possible.
5. Restrict guest printer access and audit printer share permissions.

Detection Opportunities

Defenders should investigate:

• Printer shares allowing anonymous access
• Print jobs with unusual or malformed names
• smbd spawning shell interpreters unexpectedly
• Child processes such as:

sh
bash
python
perl
nc
curl
wget

Monitoring process creation from the Samba service can help identify exploitation attempts.

Disclaimer

This repository is intended for educational and authorized security research only.

Do not use this code against systems, networks, or services without explicit permission from the owner. Unauthorized access to computer systems is illegal and unethical.

Always perform testing in isolated lab environments or platforms specifically designed for security training.