PaperCut MF and NG contain a critical unsafe dynamic class loading vulnerability that could allow an authenticated attacker to achieve full remote code execution on the server.

This is an unsafe reflection vulnerability (CWE-470) where the application instantiates database driver classes based on user-configurable parameters without proper validation. The vulnerability requires the attacker to possess high privileges to modify system configuration parameters.

The ability to execute arbitrary Java bytecode with the privileges of the PaperCut server process poses a severe risk to organizational infrastructure. Successful exploitation could lead to total system compromise, unauthorized access to sensitive print logs or user data, and lateral movement within the network. With a CVSS score of 9.4, this vulnerability is categorized as critical, necessitating immediate attention to prevent potential data breaches or service disruption.

Immediate Action: Update PaperCut MF/NG to version 24.1.10, 25.0.13, 26.0.5, or later, as specified in the official vendor security advisory.

Proactive Monitoring: Review application logs for unauthorized modifications to system configuration parameters and monitor the server for unusual process execution patterns.

Compensating Controls: Restrict administrative access to the PaperCut interface to a minimal set of trusted users and ensure the server is isolated from untrusted network segments.

Public Exploit Available: No

Given the critical severity of this vulnerability and the potential for full server compromise, administrators must prioritize patching affected PaperCut instances immediately. Ensure that all administrative accounts are secured and that the update process is validated against the official vendor bulletin to confirm full remediation of the unsafe class loading flaw.