CVE-2026-82078

PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

En bref

Sévérité: CRITICAL 9.4
Exploitation: Exploitation connue (CISA KEV) · ajoutée le 2026-08-31
Exploitée selon l'ENISA depuis le 2026-08-27
EPSS: EPSS 60.89 % · centile 99 (2026-10-27)
État: PUBLISHED
Publiée: 2026-08-28
Mise à jour: 2026-09-13
Attribuée par: PaperCut
Statut NVD: Analyzed

Description

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	CRITICAL 9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	PaperCut
CVSS 4.0	CRITICAL 9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · eb41dac7-0af8-4f84-9f6d-0272772514f4 (Secondary)
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-470

Références européennes

ENISA EUVD · EUVD-2026-67714
GCVE · GCVE-0-2026-82078

Avis du CERT-FR

CERTFR-2026-AVI-1095 — Multiples vulnérabilités dans Papercut · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* < 24.1.9
cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* ≥ 25.0.2 < 25.0.12
cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* ≥ 26.0.2 < 26.0.4
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* < 24.1.9
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* ≥ 25.0.2 < 25.0.12
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* ≥ 26.0.2 < 26.0.4

Produits affectés

Produit	Versions
PaperCut · PaperCut MF/NG	affected 0 < 24.1.10 ; affected 25.0.0 < 25.0.13 ; affected 26.0.0 < 26.0.5

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD