This vulnerability in PaperCut NG/MF's device-scripting feature allows an authenticated user with administrative interface access to inject code that escapes the sandbox environment. The flaw is due to improper control of code generation (CWE-94), enabling execution of arbitrary OS commands with admin privileges. The CVSS 4.0 score is 7.5, reflecting network attack vector, low attack complexity, required privileges at high level, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions are those prior to 25.0.12 and versions from 26.0.0 up to but not including 26.0.2.

An attacker with administrative access to the management interface can execute arbitrary operating system commands with administrative privileges on the host. This can lead to full system compromise, unauthorized data access, and disruption of services. The vulnerability requires authentication but no user interaction and has a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to device scripting. Do not deploy untrusted scripts in the management interface.