← Back

CVE-2026-82078

nvd nist
Published: Aug 28, 2026Modified: Sep 1, 2026CISA KEV

JSON object

Loading...
9.4
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: eb41dac7-0af8-4f84-9f6d-0272772514f4 (Secondary)

Description

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Affected (6)

Papercut
2 products
Papercut Mf
Papercut Ng
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Papercut
Papercut Mf
Before 24.1.9
Papercut Mf
From 25.0.2 to 25.0.12
Papercut Mf
From 26.0.2 to 26.0.4
Papercut
Papercut Ng
Before 24.1.9
Papercut Ng
From 25.0.2 to 25.0.12
Papercut Ng
From 26.0.2 to 26.0.4

Related CWEs

CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

References (3)

Source: eb41dac7-0af8-4f84-9f6d-0272772514f4
PatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Issue TrackingPatch
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.