Vulnerability record · CVE-2023-3486 · published 25 July 2023
CVE-2023-3486: PaperCut NG authentication bypass allows unauthenticated file upload
Papercut · Papercut Mf
PaperCut NG versions 22.0.12 and prior contain an authentication bypass that lets a remote, unauthenticated attacker upload arbitrary files to the host's file storage. The flaw is an unrestricted file upload (CWE-434) reachable over the network without credentials. Successful abuse can exhaust system resources and stop the service from operating as expected.
Description
An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and prevent the service from operating as expected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote file upload with high EPSS and service-disruption impact, though no KEV listing or confirmed code execution.
What it is
PaperCut NG versions 22.0.12 and prior contain an authentication bypass that lets a remote, unauthenticated attacker upload arbitrary files to the host's file storage. The flaw is an unrestricted file upload (CWE-434) reachable over the network without credentials. Successful abuse can exhaust system resources and stop the service from operating as expected.
Impact
An attacker can write arbitrary files to the PaperCut NG host and consume system resources, degrading or halting the print management service. The record does not state whether uploaded files can be executed, so code execution is not confirmed.
Attack surface
Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N). Any host that can reach the PaperCut NG service can attempt the upload.
Exploitation
Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high (0.79, 99.6th percentile), indicating elevated likelihood of exploitation activity. References are vendor and third-party advisories only, with no public exploit tag.
What to do
- Upgrade PaperCut NG to a version later than 22.0.12 per the vendor security bulletin.
- Restrict network access to the PaperCut NG service to trusted hosts and management networks.
- Monitor and cap disk and resource usage on PaperCut hosts to limit exhaustion impact.
- Review file storage directories for unexpected or unauthorized uploaded files.
Detection
- Alert on file creation events in PaperCut NG storage paths from unexpected source IPs.
- Monitor for spikes in disk usage or service unavailability on PaperCut hosts.
- Review web server logs for unauthenticated upload requests to PaperCut endpoints.
- Baseline normal upload volume and flag deviations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/ | Vendor Advisory |
| https://www.tenable.com/security/research/tra-2023-23 | Third Party Advisory |
| https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/ | Vendor Advisory |
| https://www.tenable.com/security/research/tra-2023-23 | Third Party Advisory |
Track CVE-2023-3486 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-3486), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
