Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-6418— PaperCut NG/MF: Path Traversal in Shared Account Synchronization

Quick assessment

Affected
PaperCut PaperCut NG/MF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PaperCut MF是澳大利亚PaperCut公司的一套多功能打印机控制软件。 PaperCut MF 25.0.4版本存在安全漏洞，该漏洞源于路径验证和清理不足，可能导致经过身份验证的管理员枚举目录结构并读取敏感文件。

AI Predicted 5.3 Difficulty: Moderate EPSS 0.56% · P44

Affected Version Matrix 1

VendorProduct Version RangeStatus
PaperCut PaperCut NG/MF < 25.0.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-6418

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PaperCut NG/MF: Path Traversal in Shared Account Synchronization
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
绝对路径遍历
Source: CVE Program / CVE List V5
Vulnerability Title
PaperCut MF 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PaperCut MF是澳大利亚PaperCut公司的一套多功能打印机控制软件。 PaperCut MF 25.0.4版本存在安全漏洞，该漏洞源于路径验证和清理不足，可能导致经过身份验证的管理员枚举目录结构并读取敏感文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
PaperCut PaperCut NG/MF 0 ~ 25.0.11 -

II. Public POCs for CVE-2026-6418

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-6418

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-6418 (1)

Same Patch Batch · PaperCut · 2026-05-05 · 3 CVEs total

CVE-2026-7824 PaperCut Hive (Ricoh): Plain text password in logs
CVE-2026-6180 PaperCut MF: Card truncation on HP readers

IV. Related Vulnerabilities

Same product: PaperCut NG/MF
Same vendor: PaperCut
Same weakness: CWE-36

V. Comments for CVE-2026-6418

No comments yet

Leave a comment