An administrator‑configurable synchronization feature in PaperCut MF allows the selection of a source path for account data. Because the application does not properly validate or sanitize the given path, an authenticated user with administrative privileges can submit arbitrary file paths that reside on the server’s local file system. This flaw permits data enumeration, and when the synchronization is executed the application parses the file contents and displays them in its account management interface, thereby exposing sensitive configuration or system files to the attacker. The weakness is a classic Path Traversal issue (CWE‑36) compounded by insufficient access controls (CWE‑552).

PaperCut’s Account Management Utility, specifically PaperCut NG/MF. The flaw was identified in version 25.0.4 of PaperCut MF. The description does not reference newer or older versions.

The CVSS score of 4.6 indicates low adversary effort, yet the risk intensifies if the application runs with elevated permissions. Exploitation requires an authenticated administrator. No EPSS score is provided and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation activity to date. Nonetheless, because any privileged administrator can invoke the flaw, organisations should view it as a potential confidentiality risk if the service account has broad read rights to the underlying file system.