CVE-2026-6418
CVE-2026-6418 is a medium-severity vulnerability in Papercut Papercut Mf with a CVSS 3.x base score of 4.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-36.
Key facts
- Severity: Medium (CVSS 3.x base score 4.9)
- CVSS v4: 4.6
- EPSS exploit prediction: 0% (30th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-27233
- Weakness: CWE-36
- Affected product: Papercut Papercut Mf
- Published:
- Last modified:
Description
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
Frequently asked questions
- What is CVE-2026-6418?
- An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
- How severe is CVE-2026-6418?
- CVE-2026-6418 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-6418 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-6418?
- CVE-2026-6418 primarily affects Papercut Papercut Mf. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-6418?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-6418 have an EU (EUVD) identifier?
- Yes. CVE-2026-6418 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-27233.
- When was CVE-2026-6418 published?
- CVE-2026-6418 was published on 2026-05-05 and last updated on 2026-06-17.
References
Affected products (2)
- cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
- cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
More vulnerabilities in Papercut Papercut Mf
- CVE-2023-39143 — Critical (CVSS 9.8): PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or…
- CVE-2023-27350 — Critical (CVSS 9.8): This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5…
- CVE-2019-12135 — Critical (CVSS 9.8): An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions…
- CVE-2019-8948 — Critical (CVSS 9.8): PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
- CVE-2024-1222 — High (CVSS 8.6): This allows attackers to use a maliciously formed API request to gain access to an API authorization level with…
- CVE-2023-2533 — High (CVSS 8.4): A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific…
All CVEs affecting Papercut Papercut Mf →
Other CWE-36 vulnerabilities
- CVE-2023-3765 — Critical (CVSS 10.0): Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
- CVE-2025-34392 — Critical (CVSS 9.8): Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL…
- CVE-2025-0851 — Critical (CVSS 9.8): A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad…
- CVE-2024-13161 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
- CVE-2024-13160 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
- CVE-2024-13159 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…