Read the docs
TI-2023-05533 Aliases CVE-2023-6006GHSA-83xv-2q8m-f6c3

Privilege escalation in PaperCut NG, PaperCut MF

Priority LOW 36CWE-250Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250.

Summary

This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM Note: This CVE has been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0036 30th percentileScored 2026-11-07
Fix Fixed PaperCut NG, PaperCut MF (PaperCut): 23.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PaperCutPaperCut NG, PaperCut MFbefore 23.0.023.0.0Patch availableCNA
  • PaperCut NG, PaperCut MF VendorPaperCut Affected before 23.0.0 Fixed in 23.0.0 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*before 23.0.1VulnerablePaperCut
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*before 23.0.1VulnerablePaperCut
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* Versions before 23.0.1 Vulnerable ·PaperCut
  • cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* Versions before 23.0.1 Vulnerable ·PaperCut
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA PaperCut NG, PaperCut MF (PaperCut) Fixed in 23.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6006
  2. 2026-10-03 Alias added: GHSA-83xv-2q8m-f6c3

References

Advisory 1

  • TI-2026-56642 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector KEVCVSS 4.0CRITICAL 9.4
  • TI-2023-12085 Improper access control in PaperCut NG KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-02373 PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF KEVCVSS 3.1HIGH 8.8
  • TI-2026-56284 PaperCut MF/NG: Authentication Bypass KEVCVSS 4.0HIGH 8.8
  • TI-2023-12086 Improper authentication in PaperCut NG KEVCVSS 3.1HIGH 7.5
  • TI-2023-20314 PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling… CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences