CVE-2026-82078

Name of the Vulnerable Software and Affected Versions PaperCut MF (affected versions not specified) PaperCut NG (affected versions not specified)

Description An unsafe dynamic class loading issue exists in the database connection utilities. The application instantiates database driver classes based on configurable driver names without validating them against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, they can execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.