CVE-2026-82077

CVE-2026-82077 is a path traversal vulnerability (CWE-22) affecting the Scan-to-Fax component of PaperCut NG and PaperCut MF up to versions 25.0.12 and 26.0.4. The flaw stems from improper validation and canonicalization of administrator-supplied fax provider settings. An authenticated administrator can exploit this by injecting directory traversal sequences or unexpected path components into the configuration. When the Scan-to-Fax subsystem subsequently launches the provider, the crafted path resolves to an attacker-controlled binary, allowing arbitrary command execution on the underlying host within the security context of the PaperCut service account. Security researchers from watchTowr, who tracked the issue internally as WT-2026-0144, demonstrated that this post-authentication remote code execution (RCE) vulnerability can be chained with an authentication bypass vulnerability (such as WT-2026-0143). This combination allows attackers to bypass authentication checks and achieve remote code execution on vulnerable systems. Organizations can detect potential exploitation by monitoring for unexpected modifications to Scan-to-Fax provider configurations and looking for unauthorized child processes spawned by the PaperCut service.