CVE-2024-1882 is a high severity (CVSS 7.2) server side resource injection flaw in PaperCut NG/MF. An attacker who already has admin console access can execute code on the application server. It only applies if the Job Ticketing module is installed. PaperCut fixed it in 23.0.7, 22.1.5, 21.2.14 and 20.1.10.
What's affected
PaperCut's March 2024 security bulletin says the issue applies only to organizations that installed the Job Ticketing module, which is not installed by default. The affected products are PaperCut NG and PaperCut MF, and the NVD record also lists macOS among the platforms.
The fixed releases named in the bulletin are 23.0.7 or later, 22.1.5, 21.2.14 and 20.1.10. PaperCut says the upgrade must be applied to Application Servers and to Site Servers. The bulletin also says the release includes all earlier fixes, so you can upgrade directly from any previous version.
The NVD record scores this at CVSS 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and PaperCut's bulletin gives the same 7.2. No source disagrees on severity.
How to check if you're exposed
Start with two questions. First, which version of PaperCut NG or MF does each Application Server and Site Server run? The version appears in the admin console, and PaperCut's upgrade guide covers where to look. Second, is the Job Ticketing module installed? If it is not, this particular flaw does not apply, though you should still upgrade for the other fixes in the same release.
The bulletin notes that PaperCut pushed a mitigation through auto-update of sub-components for installs that have auto-update enabled. Do not treat that as a replacement for the upgrade. Confirm the actual server version.
The attack needs admin console access, so also review who holds admin rights and whether the console is reachable from outside your management network. Keep a current inventory of where the component runs. A software bill of materials per application, refreshed on every build, turns a question like "do we run this anywhere" into a lookup instead of a week of email.
What to do now
- Identify all PaperCut NG and MF Application Servers and Site Servers and note their versions.
- Check whether the Job Ticketing module is installed on each.
- Upgrade to 23.0.7 or later, or to 22.1.5, 21.2.14 or 20.1.10 if you are on an older supported line.
- If you have to wait, limit admin console access to a small management network and review the admin account list.
- Re-check the version after the upgrade and note the date in your change record.
Why it matters
The bulletin classifies this as server side resource injection, tracked by NVD as CWE-76 (improper neutralization of equivalent special elements). In plain terms, data that an admin supplies is not cleaned well enough before the server acts on it, and that can lead to code running on the server.
The code runs as SYSTEM on Windows or as the PaperCut user on macOS and Linux, per PaperCut. That is why the impact scores as high for confidentiality, integrity and availability even though the attacker needs admin credentials first. Admin accounts get phished and reused, so a flaw that turns admin access into server control deserves a prompt patch. The record's KEV flag is false, and neither the record nor the bulletin reports exploitation of this CVE in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does CVE-2024-1882 affect every PaperCut server?
No. PaperCut says it applies only to organizations that installed the Job Ticketing module, which is not installed by default. The attacker also needs authenticated admin console access.
Which versions fix it?
PaperCut lists 23.0.7 or later, 22.1.5, 21.2.14 and 20.1.10.
Sources
Last reviewed: 19 October 2026.
