CVE-2026-6418
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In the Shared Account Synchronization component of PaperCut MF (version 25.0.4), an authenticated user with administrative privileges can specify arbitrary local file paths due to lack of path validation. This allows enumeration of directory structures and unauthorized reading of sensitive configuration or system files, whose contents are then exposed in the account management interface.
Risk Assessment
An administrator or attacker with a compromised admin account could read sensitive system and configuration files, leading to information disclosure. The scope depends on the permissions of the service account running the application.
Recommendation
Restrict PaperCut MF service account permissions to a minimum and monitor account synchronization activity. Apply the vendor patch when available and limit administrative access to trusted personnel.
Other vulnerabilities in PaperCut MF
See all- CVE-2014-2657High
An unspecified vulnerability in the print release functionality in PaperCut MF before version 14.1 (Build 26983) may lead to unknown impact and remote attack vectors, related to embedded MFPs.
- CVE-2026-6180High
A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions, the server may incorrectly process fragmented data chunks, leading to the registration of a truncated badge ID string.
Original NVD description (English source)
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS