PaperCut MF < 25.0.11 Path Traversal (CVE-2026-6418)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(313098);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/13");

  script_cve_id("CVE-2026-6418");
  script_xref(name:"IAVA", value:"2026-A-0425");

  script_name(english:"PaperCut MF < 25.0.11 Path Traversal (CVE-2026-6418)");

  script_set_attribute(attribute:"synopsis", value:
"PaperCut MF installed on the remote Windows host is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of PaperCut MF installed on the remote Windows host is prior to 25.0.11. It is, therefore, affected by
a vulnerability:

  - A path traversal vulnerability exists in the Shared Account Synchronization component of PaperCut NG/MF. Due to a
    lack of proper path validation and sanitization, an authenticated user with administrative privileges could specify
    arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the
    unauthorized reading of sensitive text-based configuration or system files. (CVE-2026-6418)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.papercut.com/kb/Main/papercut-ng-mf-and-papercut-hive-security-bulletin-may-2026/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5f4d6cd8");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PaperCut MF version 25.0.11 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-6418");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:papercut:papercut_mf");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("papercut_mf_win_installed.nbin");
  script_require_keys("installed_sw/PaperCut MF", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'PaperCut MF', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '25.0.11'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);