CVE-2023-39143: PaperCut MF

Critical severity, CVSS 9.8. EPSS: 80.1% chance of exploitation in the next 30 days.

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).

Affected products

• PaperCut PaperCut MF: before 22.1.3 (fixed in 22.1.3)
• PaperCut PaperCut NG: before 22.1.3 (fixed in 22.1.3)

Published 2023-08-04. Last modified 2026-06-17.