PaperCut MF/PaperCut NG up to 24.1.9/25.0.12/26.0.4 Database Connection Utilities externally-controlled input to select classes or code

Summaryinfo

A vulnerability identified as problematic has been detected in PaperCut MF and PaperCut NG up to 24.1.9/25.0.12/26.0.4. The impacted element is an unknown function of the component Database Connection Utilities. The manipulation leads to use of externally-controlled input to select classes or code. This vulnerability is referenced as CVE-2026-82078. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in PaperCut MF and PaperCut NG up to 24.1.9/25.0.12/26.0.4. It has been rated as problematic. This issue affects some unknown functionality of the component Database Connection Utilities. The manipulation with an unknown input leads to a use of externally-controlled input to select classes or code vulnerability. Using CWE to declare the problem leads to CWE-470. The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

It is possible to read the advisory at papercut.com. The identification of this vulnerability is CVE-2026-82078 since 08/28/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 24.1.10, 25.0.13 or 26.0.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• PaperCut

Name

• MF
• PaperCut NG

Version

• 24.1.0
• 24.1.1
• 24.1.2
• 24.1.3
• 24.1.4
• 24.1.5
• 24.1.6
• 24.1.7
• 24.1.8
• 24.1.9
• 25.0.0
• 25.0.1
• 25.0.2
• 25.0.3
• 25.0.4
• 25.0.5
• 25.0.6
• 25.0.7
• 25.0.8
• 25.0.9
• 25.0.10
• 25.0.11
• 25.0.12
• 26.0.0
• 26.0.1
• 26.0.2
• 26.0.3
• 26.0.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion