CVE-2026-14780
Received Received - Intake

Command Injection in PaperCut NG/MF

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: PaperCut

Description
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-14780
EUVD
EUVD-2026-85791

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
papercut ng *
papercut mf *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in PaperCut NG/MF's device-scripting feature due to weak sanitization and access controls in its execution engine. An authenticated admin can inject a malicious script that bypasses the sandbox, allowing unauthorized OS command execution with admin privileges.

Impact Analysis

An attacker with admin access could execute arbitrary commands on the host OS, potentially leading to full system compromise, data theft, or disruption of print services. This could expose sensitive documents or allow lateral movement within a network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Update PaperCut NG/MF to the latest version as advised in the security bulletin to mitigate potential risks. Review the official PaperCut security bulletin for specific patch instructions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart