CVE-2026-82078: CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection') in PaperCut PaperCut MF/NG

This vulnerability arises from unsafe reflection (CWE-470) in PaperCut MF and PaperCut NG. The application dynamically loads database driver classes based on user-configurable driver names but fails to restrict these to a validated allowlist. An attacker with the ability to alter system configuration parameters can exploit this to load and execute arbitrary Java bytecode present on the application's classpath, running with the privileges of the PaperCut server process. This can lead to full compromise of the affected system.

Successful exploitation allows an attacker to execute arbitrary Java code on the server hosting PaperCut MF/NG, potentially leading to full system compromise under the PaperCut server's security context. Given the high CVSS score (9.4) and the nature of the vulnerability, the impact is critical, enabling remote code execution without user interaction and requiring only high privileges to manipulate configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to system configuration parameters to trusted administrators only and monitor for unauthorized changes. Avoid exposing the PaperCut server to untrusted networks to reduce risk.