Path Traversal Vulnerability in PaperCut NG and MF Affects Fax Component

CVE-2026-82077

What is CVE-2026-82077?

CVE-2026-82077 is a critical vulnerability found in PaperCut NG and PaperCut MF, which are widely used print management solutions. This vulnerability specifically affects the Scan-to-Fax component, where an improper limitation of a pathname allows authenticated administrators to exploit a path traversal flaw. By manipulating the fax provider settings, an attacker could gain the ability to execute arbitrary commands on the underlying host. This represents a severe risk for organizations that rely on these applications for managing document workflows, as it could lead to unauthorized access and manipulation of backend systems, posing a threat to sensitive data integrity and overall system security.

Potential impact of CVE-2026-82077

1. Unauthorized Command Execution: The vulnerability allows authenticated attackers to execute arbitrary commands on the host system, which could be leveraged to manipulate files, access sensitive information, or compromise the entire server environment.

2. Data Breach Risks: Since organizations use PaperCut for managing sensitive print and document workflows, an exploit could lead to unauthorized access to confidential documents, resulting in potential data breaches or leakage of personal and proprietary information.

3. System Compromise and Further Exploitation: By gaining control of the underlying host, an attacker could install additional malicious software or establish a foothold for further attacks, potentially enabling a wider compromise of the organization's network and increased risk from other cyber threats.

References