Vulnerability intelligence

CVE-2026-82078 identifies an unsafe dynamic class-loading vulnerability present in the database connection utilities of PaperCut MF and PaperCut NG. This flaw allows the application to instantiate database driver classes using configurable driver names without proper validation against an approved allowlist of drivers. When exploited, particularly in conjunction with CVE-2026-81578 (an improper access control vulnerability), this vulnerability can enable an unauthenticated attacker to execute arbitrary Java bytecode. This chain of vulnerabilities ultimately facilitates pre-authentication remote code execution within the PaperCut Application Server.

CVE-2026-81578 describes an improper access control vulnerability found in the web management interface of PaperCut MF and PaperCut NG. This flaw allows unauthenticated remote requests, specifically those targeting administrative functions, to initiate backend actions before the system fully completes its access validation checks. The vulnerability, categorized as CWE-306 (Missing authentication for critical function), enables an unauthenticated remote attacker to modify certain system configurations. It has been observed to be actively exploited in the wild, often in conjunction with CVE-2026-82078, to achieve broader compromise.

CVE-2026-87690 is a relative path traversal vulnerability (CWE-22) affecting the `post/apple_ios/gather/ios_image_gather` post-exploitation module in the Rapid7 Metasploit Framework. The issue arises because the module interpolates file names retrieved from a Meterpreter directory listing—which can be fully controlled by a hostile or tampered iOS device—directly into the local destination path without proper sanitization. Because the underlying file-writing function writes to any supplied path, directory traversal sequences (such as `../`) can allow files to be written outside of the intended `~/.msf4/loot/` directory. An attacker controlling a compromised iOS device can exploit this flaw by luring a Metasploit operator into running the affected gather module. This allows the attacker to overwrite local files on the operator's workstation, specifically targeting the `~/.msf4/msfconsole.rc` resource file, which automatically executes at startup. By writing malicious Ruby code or loading a custom plugin through this file, the attacker can achieve persistent code execution with the operator's privileges upon the next launch of the console. The vulnerability has been addressed in Metasploit Framework version 6.5.5 and later by applying sanitization to directory listing entries.

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.