Is CVE-2026-6418 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6418 being exploited in the wild.

How severe is CVE-2026-6418?

Medium severity, with a CVSS score of 4.9, published 5 May 2026.

Which products and versions are affected?

Papercut Mf up to (excluding) 25.0.11; Papercut Ng up to (excluding) 25.0.11.

Is there a fix for CVE-2026-6418?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6418 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6418?

Check whether you run Papercut Mf or Papercut Ng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6418: PaperCut MF and NG path traversal in Shared Account Synchronization

CVE-2026-6418 · Severity: medium · CVSS 4.9 · Published 2026-05-05

PaperCut MF and NG are print management solutions used to control and monitor printing across organizations. A vulnerability in the account synchronization feature allows an administrator to access sensitive files on the underlying server that they should not be able to see. This could lead to the exposure of system configuration details or other confidential data, potentially aiding further attacks on the infrastructure.

Technologies: Papercut Mf, Papercut Ng. Vendors: PaperCut.

Quick answers

Is CVE-2026-6418 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6418 being exploited in the wild.
How severe is CVE-2026-6418?: Medium severity, with a CVSS score of 4.9, published 5 May 2026.
Which products and versions are affected?: Papercut Mf up to (excluding) 25.0.11; Papercut Ng up to (excluding) 25.0.11.
Is there a fix for CVE-2026-6418?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6418 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6418?: Check whether you run Papercut Mf or Papercut Ng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-36) exists in the Shared Account Synchronization component of PaperCut MF and NG. The application fails to properly validate or sanitize the source path provided for account data synchronization. An authenticated attacker with administrative privileges can specify arbitrary local file paths, causing the application to parse and display the contents of those files within the management interface. This allows for directory enumeration and the unauthorized reading of sensitive text-based system or configuration files, limited by the permissions of the service account running the PaperCut application. The issue is addressed in version 25.0.11.

Affected products

PaperCut PaperCut MF up to (excluding) 25.0.11
PaperCut PaperCut NG up to (excluding) 25.0.11

Timeline

2026-05-05: disclosed: Initial disclosure of the vulnerability.
2026-05-05: advisory: PaperCut released a security bulletin.
2026-05-12: other: NVD analysis and CPE information added.

References

https://www.papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.