Vulnerability in PaperCut NG/MF

[ Description ]Official description

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.

[ Fixes ]Fixes and patches

• Security bulletin: Papercut security-bulletin-sep-2026Vendor patch or bulletin · CERT-FR · papercut.com/kb/Main/security-bulletin-sep-2026, cited by CERT-FR CERTFR-2026-AVI-1223

[ Advisories ]Government CERT advisories

• CERT-FR24 Sep 2026CERTFR-2026-AVI-1223

  Multiple vulnerabilities in Papercut Translated from French

  Multiple vulnerabilities have been discovered in Papercut. Some of them allow an attacker to cause remote arbitrary code execution, a breach of data confidentiality and remote cross-site scripting (XSS).

  CVE-2026-82077CVE-2026-11744CVE-2026-87739+1 more CVEs

[ References ]References

• www.papercut.com/kb/Main/security-bulletin-sep-2026