An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server via the web-print-hot-folder.
Important: In most installations, this risk is mitigated by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server.
Update:
This CVE has been updated in May 2025 to update the fixed version and fix process. Please refer to the May 2025 Security Bulletin.
Note:
This CVE has been split from CVE-2024-3037.
References
| Link | Resource |
|---|---|
| https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/ | Vendor Advisory |
| https://www.papercut.com/kb/Main/Security-Bulletin-May-2025/ |
Configurations
Configuration 1 (hide)
|
History
13 May 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server via the web-print-hot-folder. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. Update: This CVE has been updated in May 2025 to update the fixed version and fix process. Please refer to the May 2025 Security Bulletin. Note: This CVE has been split from CVE-2024-3037. |
03 Oct 2024, 15:19
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* |
|
| First Time |
Papercut
Papercut papercut Mf Papercut papercut Ng |
|
| References | () https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/ - Vendor Advisory |
26 Sep 2024, 13:32
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-26 02:15
Updated : 2025-05-13 03:15
NVD link : CVE-2024-8404
Mitre link : CVE-2024-8404
CVE.ORG link : CVE-2024-8404
JSON object : View
Products Affected
papercut
- papercut_ng
- papercut_mf
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')