What is CVE-2026-4794?

CVE-2026-4794 is a medium-severity vulnerability in Papercut Mf, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2026-03-31.

How severe is CVE-2026-4794?

Medium severity. CVSS v3 base score is 4.8 out of 10.

XSS in Papercut Mf

CVE-2026-4794

Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's authenticated context (e.g. requires an active login session).

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (7.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.

Affected products

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

eb41dac7-0af8-4f84-9f6d-0272772514f4 (Vendor Advisory)

Frequently asked questions

What is CVE-2026-4794?: CVE-2026-4794 is a medium-severity vulnerability in Papercut Mf, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2026-03-31.
How severe is CVE-2026-4794?: Medium severity. CVSS v3 base score is 4.8 out of 10.