PaperCut NG/MF up to 25.0.10 Account Synchronization absolute path traversal

Summaryinfo

A vulnerability has been found in PaperCut NG and MF up to 25.0.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Account Synchronization Component. Performing a manipulation results in absolute path traversal. This vulnerability is cataloged as CVE-2026-6418. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in PaperCut NG and MF up to 25.0.10. This affects an unknown part of the component Account Synchronization Component. The manipulation with an unknown input leads to a absolute path traversal vulnerability. CWE is classifying the issue as CWE-36. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality. The summary by CVE is:

An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.

It is possible to read the advisory at papercut.com. This vulnerability is uniquely identified as CVE-2026-6418 since 04/16/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 313101 (PaperCut NG < 25.0.11 Path Traversal (CVE-2026-6418)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 25.0.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (313101). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• PaperCut

Name

• MF
• NG

Version

• 25.0.0
• 25.0.1
• 25.0.2
• 25.0.3
• 25.0.4
• 25.0.5
• 25.0.6
• 25.0.7
• 25.0.8
• 25.0.9
• 25.0.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion