CVE-2026-82077— PaperCut NG/MF: Remote Code Execution via Scan2Fax
Quick assessment
Affected
PaperCut PaperCut NG/MF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PaperCut NG 和 PaperCut MF 的“扫描到传真”组件中，存在一个路径遍历漏洞（即对受限目录的路径限制不当）。经过身份验证的管理员可以通过构造恶意的传真提供程序设置，在底层主机上执行任意命令。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1059 · Command and Scripting InterpreterAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PaperCut | PaperCut NG/MF | < 25.0.13 |
affected |
26.0.0< 26.0.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82077
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PaperCut NG/MF: Remote Code Execution via Scan2Fax
Source: CVE Program / CVE List V5
Vulnerability Description
An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PaperCut | PaperCut NG/MF | 0 ~ 25.0.13 | - |
|
II. Public POCs for CVE-2026-82077
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82077
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82077 (1)
Same Patch Batch · PaperCut · 2026-09-24 · 4 CVEs total
| CVE-2026-14780 | 7.5 HIGH | PaperCut NG/MF: Remote Code Execution via Scripting Subsystem |
| CVE-2026-87739 | 6.9 MEDIUM | PaperCut MF/NG: User permissions are not evaluated on report generation |
| CVE-2026-11744 | 3.8 LOW | PaperCut Hive Embedded App for Ricoh: Javascript injection |
IV. Related Vulnerabilities
Same product: PaperCut NG/MF
-
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report -
CVE-2026-14780
PaperCut NG/MF: Remote Code Execution via Scripting Subsyste -
CVE-2026-8794
PaperCut NG/MF: User enumeration via timing attack -
CVE-2026-8793
PaperCut NG/MF: Insufficient brute-force protection -
CVE-2026-6418
PaperCut NG/MF: Path Traversal in Shared Account Synchroniza
Same vendor: PaperCut
-
CVE-2026-11744
PaperCut Hive Embedded App for Ricoh: Javascript injection -
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report -
CVE-2026-14780
PaperCut NG/MF: Remote Code Execution via Scripting Subsyste -
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Con -
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
Same weakness: CWE-22
-
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-101889
Prime Mover < 2.2.1 Path Traversal via wprime-config.json -
CVE-2026-101888
Prime Mover < 2.2.1 Zip Slip Path Traversal File Write -
CVE-2026-94620
Classroom 50 vulnerable to arbitrary file overwrite on the t -
CVE-2026-95588
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbi
V. Comments for CVE-2026-82077
No comments yet