CVE-2026-6418— PaperCut NG/MF: Path Traversal in Shared Account Synchronization
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6418
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PaperCut NG/MF: Path Traversal in Shared Account Synchronization
Source: NVD (National Vulnerability Database)
Vulnerability Description
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
绝对路径遍历
Source: NVD (National Vulnerability Database)
Vulnerability Title
PaperCut MF 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PaperCut MF是澳大利亚PaperCut公司的一套多功能打印机控制软件。 PaperCut MF 25.0.4版本存在安全漏洞，该漏洞源于路径验证和清理不足，可能导致经过身份验证的管理员枚举目录结构并读取敏感文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PaperCut | PaperCut NG/MF | 0 ~ 25.0.11 | - |
II. Public POCs for CVE-2026-6418
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6418
请登录查看更多情报信息。
Same Patch Batch · PaperCut · 2026-05-05 · 3 CVEs total
| CVE-2026-7824 | PaperCut Hive (Ricoh): Plain text password in logs | |
| CVE-2026-6180 | PaperCut MF: Card truncation on HP readers |
IV. Related Vulnerabilities
Same product: PaperCut NG/MF
Same vendor: PaperCut
- CVE-2026-7824
PaperCut Hive (Ricoh): Plain text password in logs - CVE-2026-6180
PaperCut MF: Card truncation on HP readers - CVE-2026-5115
Session hijacking in PaperCut NG/MF embedded application for - CVE-2026-4794
Multiple cross-site scripting (XSS) vulnerabilities in Paper - CVE-2025-9785
Misconfigured certificate validation with self-signed certif
Same weakness: CWE-36
- CVE-2026-44029
Nix 安全漏洞 - CVE-2026-7217
Deepractice PromptX Document File index.ts read_pdf absolute - CVE-2026-34515
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in - CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File R - CVE-2026-0846
Arbitrary File Read via Absolute Path Input in nltk.util.fil
V. Comments for CVE-2026-6418
No comments yet