File Path Injection Vulnerability in PaperCut MF for Enhanced Account Synchronization

CVE-2026-6418

What is CVE-2026-6418?

A vulnerability in the Shared Account Synchronization component of PaperCut MF version 25.0.4 allows authenticated administrative users to specify unvalidated file paths in the application. This lack of proper validation can lead to directory enumeration and unauthorized access to sensitive configuration or system files. When the synchronization process is initiated, the application may expose critical data through its account management interface, potentially revealing sensitive information depending on the permissions granted to its service account. This could pose serious risks to system integrity and confidentiality.

References