CVE-2026-14780 — PaperCut NG/MF: Remote Code Execution via Scripting Subsystem
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution eng…
Published: 2026-09-24 · CVSS: 7.5 · CVSS 4.0
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7