CVE-2026-82077: PaperCut Path Traversal Vulnerability

CVE-2026-82077 Overview

CVE-2026-82077 is a path traversal vulnerability [CWE-22] in the Scan-to-Fax component of PaperCut NG and PaperCut MF. An authenticated administrator can craft malicious fax provider settings to break out of the restricted directory and execute arbitrary commands on the underlying host. The flaw stems from improper limitation of a pathname to a restricted directory when the application processes fax provider configuration input. Successful exploitation grants command execution in the context of the PaperCut service account, which typically holds elevated privileges on print servers.

Critical Impact
An authenticated administrator can leverage crafted fax provider settings to execute arbitrary operating system commands on PaperCut print servers, with potential downstream impact on print infrastructure and connected systems.

Affected Products

PaperCut NG
PaperCut MF
Scan-to-Fax component (fax provider configuration)

Discovery Timeline

2026-09-24 - CVE-2026-82077 published to the National Vulnerability Database (NVD)
2026-09-25 - Last updated in NVD database
September 2026 - PaperCut Security Bulletin released addressing the issue

Technical Details for CVE-2026-82077

Vulnerability Analysis

The vulnerability resides in how the Scan-to-Fax component handles pathname input supplied through fax provider settings. The application fails to properly validate or sanitize path components, allowing traversal sequences to escape the intended restricted directory. Because the fax provider configuration is processed by server-side logic with the privileges of the PaperCut service, path traversal translates directly into arbitrary command execution on the host.

Exploitation requires authenticated administrator access. This elevates the attack prerequisites but does not neutralize the risk, because administrator credentials are frequently exposed through credential reuse, phishing, or compromise of adjacent management systems. Once an attacker reaches the administrator console, the Scan-to-Fax configuration becomes a reliable path to full host compromise.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Input accepted by the fax provider settings is used to construct file or command paths without canonicalization or allow-list enforcement. Traversal payloads containing ../ or absolute path references bypass the intended containment and reach executable locations on disk.

Attack Vector

The attack vector is network-based and requires high privileges. An authenticated administrator submits crafted fax provider settings through the PaperCut administrative interface. The malicious payload coerces the Scan-to-Fax component into referencing attacker-controlled paths, which the server then invokes or writes to, resulting in command execution. No user interaction beyond the attacker's own administrative session is required.

See the PaperCut Security Bulletin September 2026 for vendor-provided technical details.

Detection Methods for CVE-2026-82077

Indicators of Compromise

Unexpected modifications to Scan-to-Fax or fax provider configuration entries in the PaperCut administrative console.
PaperCut service processes spawning child processes such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash outside of normal print workflows.
File system artifacts written outside the expected PaperCut installation directories by the PaperCut service account.
Administrator logins from unusual source addresses or at unusual times preceding fax provider configuration changes.

Detection Strategies

Monitor PaperCut application and audit logs for changes to fax provider settings, particularly values containing .., backslashes, or absolute paths.
Alert on process lineage where the PaperCut Java process or application server launches shell interpreters or scripting hosts.
Correlate administrative authentication events with subsequent configuration changes to the Scan-to-Fax module.

Monitoring Recommendations

Enable and centralize PaperCut audit logging, forwarding events to a SIEM for retention and correlation.
Baseline normal process behavior of the PaperCut service account and alert on deviations such as outbound network connections or file writes to system directories.
Review administrator account inventory and enforce multi-factor authentication to reduce the risk of unauthorized access to the admin console.

How to Mitigate CVE-2026-82077

Immediate Actions Required

Apply the fixed PaperCut NG or PaperCut MF release referenced in the PaperCut Security Bulletin September 2026.
Restrict access to the PaperCut administrator interface to trusted management networks only.
Rotate administrator credentials and enforce multi-factor authentication on all administrative accounts.
Audit current fax provider configurations for traversal sequences or unexpected path values and revert any suspicious entries.

Patch Information

PaperCut has published remediation guidance in the September 2026 security bulletin. Administrators should upgrade PaperCut NG and PaperCut MF to the fixed versions identified by the vendor. Refer directly to the PaperCut Security Bulletin September 2026 for exact fixed version numbers and upgrade procedures.

Workarounds

Disable the Scan-to-Fax feature if it is not required in your environment until the patch is applied.
Limit administrative access to the PaperCut console using network segmentation, VPN, or IP allow-lists.
Run the PaperCut service under a least-privilege account to constrain the impact of command execution.
Monitor and review all administrator configuration changes with timely alerts to the security team.

bash

# Example: restrict access to PaperCut admin interface (port 9191) at the host firewall
# Allow only a dedicated management subnet, deny all other sources
iptables -A INPUT -p tcp --dport 9191 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9191 -j DROP