CVE-2023-39470 is a high severity (CVSS 7.2) exposed dangerous function in the print.script.sandboxed setting of PaperCut NG. An authenticated administrator could run code as SYSTEM. PaperCut's June 2023 bulletin says its security hardening in version 22.1.1 resolves the issue, and rates the chained flaw 6.5.
What's affected
The NVD record lists PaperCut NG as the affected product. It scores the flaw 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, which requires high privileges. Per ZDI-24-786, the flaw is in the management of the print.script.sandboxed setting, where a dangerous function is exposed, and code runs as SYSTEM.
The sources differ on the details. PaperCut's June 2023 bulletin describes a chained vulnerability, ZDI-CAN-20965, about the ability to configure scripts to call executables once admin access is gained. It rates that issue 6.5 and says it is fixed in 22.1.1 through the security hardening layer, a new security.properties file. The bulletin calls it CVE-2023-39469, while NVD assigns this CVE, CVE-2023-39470, to ZDI-CAN-20965. The record also published in November 2024, long after the June 2023 fix.
So the fixed version is PaperCut 22.1.1 or later, as the June bulletin says. Later bulletins in the series recommend newer releases, so moving to the current release on your branch is the better target. The record lists only PaperCut NG, while PaperCut's bulletin speaks of both NG and MF.
The weakness class is CWE-749 (exposed dangerous method or function). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Check the PaperCut version on each application server in the administration interface, on the About page. Anything before 22.1.1 predates the hardening described in the June 2023 bulletin.
Then check whether print scripting is enabled and who can edit scripts. In 22.1.1 and later, scripting settings that can run executables were moved to a security.properties file, so the setting is controlled outside the web interface.
What to do now
- Inventory every PaperCut NG and MF server and its version.
- Upgrade to 22.1.1 at least, and preferably to the latest release on your branch. Read the upgrade checklist, because customers who use scripting may have extra configuration steps.
- Review the print scripting and device scripting settings and turn off anything you do not use.
- Restrict administrator accounts to a small list and require strong authentication.
- Keep the administration interface on an internal network.
Why it matters
Exposure of a dangerous function means a feature gives an administrator a way to run something powerful, here the ability to configure scripts that can call executables. The ZDI advisory says the result is code execution as SYSTEM, which is the top account on a Windows server.
The need for admin access limits the reach, and PaperCut's own score is lower than the NVD score. PaperCut's reasoning for the hardening is that attackers chain steps. If another flaw gives an attacker admin access, a feature like this turns it into control of the server. Closing it in advance is the point of the 22.1.1 changes.
Quick check
Is the vendor score different from NVD?
Yes. PaperCut's June 2023 bulletin rates the chained flaw 6.5, while the NVD record gives 7.2. We report both.
Is this the same as CVE-2023-39469?
They are separate CVEs in NVD, but PaperCut's June 2023 bulletin attaches ZDI-CAN-20965 to CVE-2023-39469. That is a conflict between sources.
Sources
- Zero Day Initiative advisory ZDI-24-786
- PaperCut NG/MF Security Bulletin, June 2023
- PaperCut NG/MF Security Bulletin, July 2023
- Safeguard Gold entry for CVE-2023-39470
Last reviewed: 19 October 2026.
