CVE-2026-82078

Published: Ago 28, 2026 Last Modified: Ago 28, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,4
Source: eb41dac7-0af8-4f84-9f6d-0272772514f4
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Other
Potential Impacts:
Execute Unauthorized Code Or Commands Alter Execution Logic Dos: Crash, Exit, Or Restart Other Read Application Data
Applicable Platforms
Languages: Java, PHP, Interpreted
View CWE Details
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2…
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-…