The vulnerability is an improper limitation of a pathname to a restricted directory (path traversal) in the Scan-to-Fax component of PaperCut NG and PaperCut MF. An authenticated administrator can supply a specially crafted fax provider setting that exploits the path traversal to execute arbitrary commands on the host OS. This results in full remote code execution, giving the attacker control over the underlying machine. The flaw maps to CWE-22 and CWE-78.

Both PaperCut NG and PaperCut MF products contain the affected Scan-to-Fax feature. The CVE entry does not list specific affected versions, implying that all releases of NG/MF that include this component may be vulnerable until a patch is applied. Administrators who manage any instance of these products should be aware that the attack can be triggered from within the application.

The CVSS score of 7.3 indicates a high severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrative credentials, so the threat is primarily internal. Once the attacker gains authenticated access, they can inject arbitrary commands via the provider settings. Organizations that have not yet applied the vendor’s security bulletin should treat this as a high risk and prioritize remediation.