Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| PaperCut | PaperCut MF/NG | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 28 Aug 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. | |
| Title | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | |
| Weaknesses | CWE-470 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: PaperCut
Published:
Updated: 2026-08-28T11:45:25.388Z
Reserved: 2026-08-28T00:13:25.684Z
Link: CVE-2026-82078
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-28T16:18:31.240
Modified: 2026-08-28T16:18:31.240
Link: CVE-2026-82078
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-28T17:30:08Z
-
CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')