PT-2026-29169 · Papercut · Papercut Ng/Mf

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-4794

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PaperCut NG/MF versions prior to 25.0.10

Description The software contains multiple cross-site scripting (XSS) flaws. Authenticated administrator users can inject arbitrary web script or HTML code through various UI fields. This could lead to the compromise of other administrator sessions or the execution of unauthorized actions within the administrator's authenticated context, requiring an active login session.

Recommendations Update PaperCut NG/MF to version 25.0.10 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4794

Affected Products

Papercut Ng/Mf

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4794 · Security Note
• https://papercut.com/kb/Main/papercut-ng-mf-security-bulletin-march-2026 · Vendor Advisory
• https://twitter.com/CVEnew/status/2038916061450625037 · Twitter Post
• https://twitter.com/autumn_good_35/status/2038999097450144213 · Twitter Post
• https://twitter.com/CVEarity/status/2038914790626906275 · Twitter Post