CVE-2023-39143

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

80.62% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-22

Published

2023-08-04

Updated

2025-05-05

Proof-of-concept exploits (3)

• https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerabil…
• foregenix/CVE-2023-39143
• GodCuChu/DZ10

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39143.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-54309
• CVE-2023-39141
• CVE-2023-39144
• CVE-2023-3914
• CVE-2023-39147
• CVE-2023-39139