PT-2026-36983 · Papercut · Papercut Mf

Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-6418

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PaperCut MF version 25.0.4

Description An issue in the Shared Account Synchronization component allows authenticated administrative users to specify arbitrary file paths on the local file system due to insufficient path validation and sanitization. By configuring a malicious source path, an attacker can enumerate directory structures and read sensitive text-based system or configuration files. When the synchronization process is triggered, the application parses the file contents and displays the data within the account management interface, potentially disclosing sensitive information based on the service account's permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-36

CWE-552

Related Identifiers

CVE-2026-6418

Affected Products

Papercut Mf

References · 6

• https://papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6418 · Security Note
• https://twitter.com/infoflowcloud/status/2051596937296556390 · Twitter Post
• https://twitter.com/CVEnew/status/2051595421806653749 · Twitter Post
• https://t.me/cveNotify/163245 · Telegram Post
• https://t.me/CVEtracker/52723 · Telegram Post