Description
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox.
A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PaperCut | PaperCut NG/MF | < 24.1.11, 25.0.0 – < 25.0.12, 26.0.0 – < 26.0.2 | 24.1.11 |