CVE-2026-82077

UNKNOWN

Description

An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.

Timeline

Published:September 24th, 2026 7:16 AM

Last modified:October 13th, 2026 4:17 AM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-22 CWE-78

References & Reports

Advisories, patches, and third-party reports

https://www.papercut.com/kb/Main/security-bulletin-sep-2026/

Source: NIST NVD · Data may lag official sources by up to one minute