Product and affected versions
PaperCut NG and PaperCut MF print management software. Older releases from before PaperCut’s June 2023 security fixes are affected.
Severity and CVE ID
The flaw is tracked as CVE-2023-2533, a high-severity cross-site request forgery (CSRF) vulnerability. On July 28, 2025, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Vulnerability
Under specific conditions, the CSRF flaw could let an attacker change the server’s security settings or execute arbitrary code. It is exploitable only when the target is a PaperCut administrator with an active login session.
How the attack works
The attacker tricks a logged-in administrator into clicking a specially crafted link, for example in a phishing email. The administrator’s browser then sends requests to the PaperCut server on their behalf, making unauthorised configuration changes that can lead to code execution.
Remediations
- Upgrade PaperCut NG/MF to the latest release. PaperCut’s June 2023 security bulletin lists the first fixed version for each release line.
- Make sure the PaperCut admin interface is not reachable from the internet, and restrict it to trusted networks.
- Remind administrators not to open untrusted links while logged in to the admin console.
Reference
See the NVD entry for CVE-2023-2533, CISA’s KEV catalog and PaperCut’s security bulletins.
