This vulnerability exists in PaperCut MF 25.0.4's Shared Account Synchronization feature, where administrative users can configure a source path for account data synchronization without proper validation or sanitization. This flaw permits an authenticated admin to specify arbitrary local file paths, leading to directory enumeration and unauthorized reading of sensitive text-based files. When synchronization runs, the application parses and exposes the file contents within its interface, potentially leaking sensitive system or configuration information depending on service account privileges.

An authenticated user with administrative privileges can exploit this vulnerability to read arbitrary files on the local filesystem. This may result in disclosure of sensitive configuration or system information accessible to the service account running PaperCut MF. The vulnerability does not allow privilege escalation or remote code execution but can compromise confidentiality of sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and carefully control which users have synchronization configuration privileges to reduce risk.