TI-2026-05633 Aliases CVE-2026-6418 GHSA-mhwr-j844-q9pq

PaperCut NG/MF: Path Traversal in Shared Account Synchronization

LOW 22CWE-36Published 2026-05-05 · Updated 2026-06-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-552.

Summary

An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00559 46th percentileScored 2026-11-07

Fix Fixed PaperCut NG/MF (PaperCut): 25.0.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PaperCut	PaperCut NG/MF	before 25.0.11	25.0.11	Patch available	CNA

PaperCut NG/MF VendorPaperCut Affected before 25.0.11 Fixed in 25.0.11 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:papercut:papercut_mf::::::::	before 25.0.11	Vulnerable	PaperCut
cpe:2.3:a:papercut:papercut_ng::::::::	before 25.0.11	Vulnerable	PaperCut

cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* Versions before 25.0.11 Vulnerable ·PaperCut
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* Versions before 25.0.11 Vulnerable ·PaperCut

Remediation

Fix · CNA PaperCut NG/MF (PaperCut) Fixed in 25.0.11

Timeline

2026-10-02 Threatist record created from CVE-2026-6418
2026-10-03 Alias added: GHSA-mhwr-j844-q9pq

References

Advisory 1

https://www.papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026/

TI-2026-56642 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector KEVCVSS 4.0CRITICAL 9.4
TI-2023-12085 Improper access control in PaperCut NG KEVCVSS 3.1CRITICAL 9.8
TI-2023-02373 PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF KEVCVSS 3.1HIGH 8.8
TI-2026-56284 PaperCut MF/NG: Authentication Bypass KEVCVSS 4.0HIGH 8.8
TI-2023-12086 Improper authentication in PaperCut NG KEVCVSS 3.1HIGH 7.5
TI-2023-20314 PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling… CVSS 3.1CRITICAL 9.8

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences