CVE-2026-6418

An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.

• CWE-36
• CWE-552

• https://www.papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026/Mitigation, Vendor Advisory

Published

May 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64174In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64175In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-64176In the Linux kernel, the following vulnerability has been re…8.1
• CVE-2026-64177In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64178In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-64179In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64180In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64181In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64182In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64183In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64184In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64185In the Linux kernel, the following vulnerability has been re…5.5