{"id":"CVE-2023-39143","aliases":["EUVD-2023-42884","GHSA-mm5w-gqw5-m4qx"],"status":"published","title":"PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables...","description":"PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.80065,"percentile":0.9962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2023-08-04T00:00:00Z","modified":"2026-06-17T06:11:37Z","exploits":[{"source":"nuclei","id":"CVE-2023-39143","title":"PaperCut \u003c 22.1.3 - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39143.yaml"},{"source":"pocgithub","id":"foregenix/CVE-2023-39143","title":"foregenix/CVE-2023-39143","date":"2025-10-09","url":"https://github.com/foregenix/CVE-2023-39143"}],"products":[{"vendor":"papercut","product":"papercut_mf"},{"vendor":"papercut","product":"papercut_ng"}],"references":[{"url":"https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.papercut.com/kb/Main/securitybulletinjuly2023/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39143"},{"url":"https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability"},{"url":"https://www.papercut.com/kb/Main/securitybulletinjuly2023"},{"url":"https://github.com/advisories/GHSA-mm5w-gqw5-m4qx"}],"sources":{"cve":[{"id":"CVE-2023-39143","description":"PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).","status":"published","published":"2023-08-04T00:00:00Z","modified":"2025-05-05T15:56:10.491Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:33.138994Z"}],"euvd":[{"id":"EUVD-2023-42884","description":"PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).","status":"published","published":"2023-08-04T00:00:00Z","modified":"2025-05-05T15:56:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:57.470964Z"}],"ghsa":[{"id":"GHSA-mm5w-gqw5-m4qx","title":"PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables...","description":"PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.","status":"published","published":"2023-08-04T18:30:39Z","modified":"2024-04-04T06:33:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:56:43.722866Z"}],"nvd":[{"id":"CVE-2023-39143","description":"PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).","status":"published","published":"2023-08-04T17:15:11.51Z","modified":"2026-06-17T06:11:37.693Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:20.798312Z"}]}}