This vulnerability is an improper limitation of a pathname to a restricted directory (CWE-22) combined with command injection (CWE-78) in PaperCut NG/MF's Scan-to-Fax feature. An authenticated administrator can craft fax provider settings to perform path traversal and execute arbitrary commands on the host system. The flaw affects versions >=0 and <25.0.13, and >=26.0.0 and <26.0.5. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond administrator, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated administrator to execute arbitrary commands on the underlying host, potentially leading to full system compromise. The impact includes complete control over the affected system's confidentiality, integrity, and availability. However, exploitation requires administrative privileges, limiting the attack surface to trusted users with elevated access.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and carefully validate fax provider settings. Monitor vendor communications for official patches or updates addressing this vulnerability.