PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct

PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's...

Apache Tapestry - Remote Code Execution

Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the...

CVE_2021_27850_POC

Usage git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Assuming the HMAC key is change this immediate...

asf__tapestry-5_CVE-2019-0207_5-4-4

This repository does not have a README...

CVE-2021-27850_POC

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache...

CVE-2021-27850_POC

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache...

PaperCut CVE-2026-81578 Auth Bypass Detect

Detects CVE-2026-81578 in PaperCut NG/MF before 24.1.10 / 25.0.13 / 26.0.5. Apache Tapestry direct/1/Home/ConfigEditor requests validate only the render page Home while invoking privileged ConfigEditor listeners without a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

PaperCut CVE-2026-82078 SQL Primitive Detect

Detects CVE-2026-82078 in PaperCut NG/MF when chained with CVE-2026-81578: attacker-controlled user-lookup SQL templates and JDBC driver settings can be written via unauthenticated Tapestry ConfigEditor direct-service requests. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

PaperCut NG/MF Pre-Auth RCE (CVE-2026-81578 + CVE-2026-82078)

Chains CVE-2026-81578 Tapestry direct-service auth bypass with CVE-2026-82078 external user-lookup JDBC abuse. On PaperCut 26.x, reconfigures H2 INIT SQL to evaluate Groovy that launches a shell command, then restores factory lookup settings. !/usr/bin/env python3 -- coding: utf-8 -- """PaperCut...

CVE-2026-61899

A flaw was found in Apache Tapestry tapestry-core. A remote attacker could exploit this vulnerability by manipulating URLs to download sensitive classpath assets. This could lead to unauthorized access to internal application resources. Mitigation Mitigation for this issue is either not available...

Exploit for CVE-2026-81578

Professional security research tool for PaperCut NG/MF vulne...

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=4.0.0.release), be.eliwan:tapestry5-high (>=1.1, <=1.2) +38 more potentially affected by CVE-2026-61899 via org.apache.tapestry:tapestry-core (>=5.5.0, <=5.9.0-preview-2)

org.apache.tapestry:tapestry-core MAVEN version =5.5.0, =2.0.0.release, =1.1, =0.0.1, =3.0, =3.0, =3.0, =2.0.0, =1.5.0, =0.7.2, =0.7.2, =1.2, =3.0.m1, =3.0 and more Source cves: CVE-2026-61899 Source advisory: SNYK:JAVA-ORGAPACHETAPESTRY-19432166...

Incorrect Authorization

Overview org.apache.tapestry:tapestry-core is a Tapestry Core package for Apache Tapestry. Affected versions of this package are vulnerable to Incorrect Authorization via specially crafted URLs in the tapestry-core. An attacker can access sensitive files from the classpath by manipulating the URL...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

EUVD-2026-55243

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=4.0.0.release), be.eliwan:tapestry5-high (>=1.1, <=1.2) +38 more potentially affected by CVE-2026-61899 via org.apache.tapestry:tapestry-core (>=5.5.0, <=5.9.0-preview-2)

org.apache.tapestry:tapestry-core MAVEN version =5.5.0, =2.0.0.release, =1.1, =0.0.1, =3.0, =3.0, =3.0, =2.0.0, =1.5.0, =0.7.2, =0.7.2, =1.2, =3.0.m1, =3.0 and more Source cves: CVE-2026-61899 Source advisory: MEND:CVE-2026-61899...

CVE-2026-61899

A vulnerability exists in the tapestry-core component of Apache Tapestry (version 5.5.0+ on all platforms). An attacker can exploit Incorrect Authorization by manipulating URLs to download sensitive classpath assets , which may lead to unauthorized access to internal application resources. Users ...