Arbitrary File Creation in PaperCut NG/MF Web Print Image Handler

CVE-2024-4712

What is CVE-2024-4712?

An arbitrary file creation vulnerability is present in PaperCut NG/MF impacting Windows servers with Web Print enabled. This vulnerability arises from an issue within the image-handler process that can mishandle input to create files that do not exist when supplied with specially crafted payloads. As a result, this flaw can lead to local privilege escalation, particularly in scenarios where standard network users have been granted local login access on the affected servers. Organizations utilizing PaperCut NG/MF should prioritize mitigation strategies to secure their installations.

References