CVE-2024-4712: High File Creation Flaw in PaperCut NG/MF

CVE-2024-4712 is a high severity arbitrary file creation flaw in the Web Print image handler of PaperCut NG/MF, scored 7.8. It only affects Windows servers with Web Print enabled and can lead to local privilege escalation. PaperCut fixed it in NG/MF 23.0.9, so upgrade to that or a later release.

What's affected

The PaperCut security bulletin for May 2024 says the flaw affects PaperCut NG/MF Windows servers with the PaperCut Web Print Server service enabled. The image-handler process can create files that do not exist when it receives a malformed payload, which could allow file creation in locations used by the Web Print service. The bulletin credits the report to Trend Micro Research.

The fixed release is 23.0.9. The bulletin says the issues remain fixed as of 23.0.9, and that up to date servers need not take further action.

There is a record note worth knowing. The CVE was split into two, CVE-2024-4712 and CVE-2024-8405, and rescored. NVD records the vector as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High), which matches the 7.8 in the vendor table. PaperCut's own overview, however, assesses the issues as low risk in practice. It singles out servers that allow console or local login for non-admin users as the ones to prioritize. So the rating is high on paper and low in the vendor's practical view, and both statements are true.

The weakness is listed as CWE-77, command injection. The KEV flag is false.

How to check if you're exposed

1. Confirm the server runs Windows. Linux and macOS servers are outside this issue.
2. Confirm Web Print is enabled and the PaperCut Web Print Server service is running.
3. Log in to the admin interface and open the About tab to read the version. Anything below 23.0.9 should be upgraded.
4. Check who can log in to the server console. Local access is the precondition in the vector.

PaperCut's bulletin describes the simple upgrade path: log in to the admin interface, open the About tab, and use Check for updates for a standard over-the-top update.

What to do now

1. Back up the server and the application data.
2. Upgrade to 23.0.9 or later using the over-the-top update.
3. Reduce who has local or console login to the print server to administrators.
4. Review whether Web Print is needed on that server, and turn it off if it is not.
5. Read the bulletin for the answer on Web Print Sandbox servers.
6. Record the new version in your asset inventory.

Why it matters

File creation bugs matter when the service runs with higher rights than the user who triggers it. A user with only local access can persuade a privileged service to write a file somewhere it should not, and from there reach more control. That is the pattern of local privilege escalation.

The practical advice from the vendor is helpful: environments where only admins log in to the server have less to worry about. Where many people can log in to a print server, such as school labs or shared kiosks, the exposure is higher and patching moves up the list.

Quick check

Sources

• PaperCut security bulletin, May 2024
• NVD record data for CVE-2024-4712

Last reviewed: 19 October 2026.