Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
watchTowr details a PaperCut pre-auth RCE chain exploited in the wild and repeated patch bypasses.
86
Vulnerability2 · 1 read
CVE-2026-82077
Path Traversal RCE in PaperCut NG and PaperCut MF Fax Component
- CVSS 4.0
- 7.3 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
This vulnerability involves an improper path traversal flaw in the Scan-to-Fax component of PaperCut NG and PaperCut MF, allowing authenticated administrators to execute arbitrary commands on the underlying host. An attacker can craft fax provider settings to trigger arbitrary host command execution. Affected products are PaperCut NG and PaperCut MF, and the current exploitation status is none known. The vulnerability has not yet been publicly exploited.
What to do: Upgrade to patched versions of PaperCut NG and PaperCut MF. Implement path traversal controls and restrict access to restricted directories. Monitor for affected installations and restrict fax provider settings.
| Product | Affected |
|---|---|
| PaperCut NG | patched versions |
| PaperCut MF | patched versions |
Estimated exposure
moderate≈10k-100k affected devices/sites (plugin active installs and internet-exposed device counts) — Based on plugin active install counts and public exposure patterns, the affected scope is estimated as a moderate scale (10k-100k systems/user count).
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.
- Weakness
- CWE-22, CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X