vulnerability
PaperCut NG: CVE-2023-31046: Improper Limitation of a Pathname to a Restricted Directory
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:S/C:C/I:N/A:N) | Oct 19, 2023 | Apr 22, 2025 | Jul 2, 2025 |
Severity
7
CVSS
(AV:N/AC:L/Au:S/C:C/I:N/A:N)
Published
Oct 19, 2023
Added
Apr 22, 2025
Modified
Jul 2, 2025
Description
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach getStaticContent in UIContentResource.class in the static-content-files servlet.
Solution
papercut-ng-upgrade-latest
References
- CWE-22
- CVE-2023-31046
- https://attackerkb.com/topics/CVE-2023-31046
- URL-https://research.aurainfosec.io/disclosure/papercut/
- URL-https://web.archive.org/web/20230814061444/https://research.aurainfosec.io/disclosure/papercut/
- URL-https://www.papercut.com/kb/Main/PO-1216-and-PO-1219#security-notifications
- URL-https://www.papercut.com/kb/Main/SecurityBulletinJune2023
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.