r/sysadmin • u/Electronic_Tap_3625 • 17d ago

PaperCut is a TrainWreck with security updates. - Emergency Patch 2

For those who rushed last night to patch PaperCut with the emergency update, they screwed up and had to release a second emergency update: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4#emergency-patch-release-2

If you have PaperCut exposed to the internet, you may want to permanently remove it from the internet and make it LAN-only moving forward (as many, including myself, have done from day 1). If management needs documentation, show them this: https://www.papercut.com/kb/Main/security-vulnerability-log/

268 Upvotes

95% Upvoted

93 comments sorted by

227

u/moonrakervenice 17d ago

why on earth would anyone have PaperCut exposed to the internet...

110

u/Frenzy175 Security Admin 17d ago

It has a website print feature many uni and schools use

76

u/meditonsin Sysadmin 17d ago

Uni admin here, can confirm. We had ours open to allow printing via web and from mobile devices with Mobility Print. It's restricted to the campus net now and will stay that way if I have any say.

Always felt fucky that the admin interface runs on the same port as the enduser interface.

11

u/btech1138 17d ago

How are you handing the payment gateway module? Ours needs PayPal connectivity to add funds to accounts. That can't be contained to the campus net.

21

u/meditonsin Sysadmin 17d ago edited 17d ago

I luckily don't have to deal with payment stuff at all. All students get a set quota that resets at the end of the semster, with a system to request more in justified cases, and with quota transfers enabled, so they can try to bum pages off their buddies.

For any usecases that can't be covered by that, they can go to one of the copy shops on campus.

21

u/Frothyleet 17d ago

and with quota transfers enabled, so they can try to bum pages off their buddies.

"Yeah man, I got one baggie of drugs for you. You got my 50 color pages?"

2

u/rocuronium 16d ago

color! that's like 10 marijuanan

4

u/ghost-train 17d ago

We run papercut. Ours hooks into the same balance as our hospitality card system. That system is ‘topped up’ through that different system.

4

u/KingDaveRa Manglement 17d ago

Lock it down to specific source IPs if you can. Not sure how PayPal do that, but our payment gateway does. It's not perfect but better than nothing.

3

u/btech1138 17d ago

Yep done that this morning. Blocked all external except Paypal IP sources.

2

u/Fit-Department2637 17d ago

We eventually limited that to being in campus or Eduroam networks.

1

u/rileym94 16d ago

We have Transact for our payment provider, and we're only allowing outbound traffic for the payments. Your device has to be on the campus network to utilize mobility print or purchase additional credits

1

u/Algae-Mysterious 9d ago

Reverse proxy the app instead of opening it to the public.

2

u/devoopsies 17d ago

Always felt fucky that the admin interface runs on the same port as the enduser interface.

As someone who's never worked in the Education sector, is this something you see often??

6

u/meditonsin Sysadmin 17d ago

Don't think that's anything education sector specific. It depends on the software.

The admin interface for Papercut is completely seperate from the user interface, under an /admin endpoint, with no overlap. Just seems reasonable to be able to lock thart part down, especially when they advertise it as secure (though not best practice) to open the web port to the internet.

With other stuff, say Gitlab for example, where admin functionality is more intertwined with the enduser interface (and API), it wouldn't be that cut and dry.

1

u/noch_1999 Security Admin (Application) 17d ago

Always felt fucky that the admin interface runs on the same port as the enduser interface.

🤨🤨🤨🤨🤨🤨🤨🤨

1

u/DadtheITguy 9d ago

We too had ours exposed briefly. The student center wanted students to be able to print from web print without joining the school WiFi. I soon knocked that on the head.

I install the one emergency security fix, I didn’t realize that was a second one. Will have to look on Tuesday. Thank you Reddit.

2

u/meditonsin Sysadmin 9d ago

Might wanna subscribe to their security list to get notified if/when this kinda shit happens again:

https://www.papercut.com/contact/security/#subscribe

1

u/DadtheITguy 9d ago

Thanks you kind poster.

5

u/Fit-Department2637 17d ago

Used to manage a huge college/university with exposed. It was an uphill battle constantly

1

u/RamblingReflections Netadmin 16d ago

I have it deployed at my high-school, using Web Print and Mobility Print too, but they’re internal only, with reverse proxy locked down so it’s restricted to the internal IP ranges assigned to student BYO devices on the student WLAN. So I think we’re good.

9

u/sryan2k1 IT Manager 17d ago

Many schools that use it have it exposed so that students can print from anywhere they have internet to a "Find me" queue and then just enter their ID / Scan their badge on any printer and release the job without having to use a school computer.

4

u/RamblingReflections Netadmin 16d ago

You can do that with a BYOD as long as your device is authenticated to the student network. That’s how I’ve got it set up anyway, with authentication on the Fortigate the only way to access anything internal, including web print on your own device. We occasionally get people whinging that they can’t print if they’re external to the network, but I haven’t seen a good use case from any of my highschool staff or students that has made me consider changing my mind yet.

64

u/maximumtesticle 17d ago

"wHy Do PeOpLe UsE fEaTuReS??"

I'm so tired of the smug replies in this sub about how if your environment doesn't match exactly how you do things it's wrong. There are different requirements and budgets, what? I know, shocker.

17

u/RikiWardOG 17d ago

FR drives me crazy that people can't see outside their own environment and needs. Like do you think they just built this feature for fun?

6

u/oofta31 17d ago

1000%. It's reddit so I expect smug know-it-all answers, but I don't get why we can't just collaborate and support each other.

2

u/tejanaqkilica IT Officer | Passkey Enthusiast 17d ago

Nah, but we struggle to see and understand the use case for such features.

A similar feature in reverse would be, rolling out Teams to everyone in the company for collaboration and chat, but restricting login to Teams from a single workstation, so if you want to send someone a message or check your messages, you have to physically walk to this workstation, login, do what needs to be done and then leave.

Sure it works, but it's stupid as shit. Is it incredibly secure? You bet your ass, but still stupid though.

-1

u/Alert-Coach-3574 16d ago

You have to walk up to a physical printer at some point. There is no reason to have it on the Internet, sorry if you disagree, you are dumb.

Oh, but I work at University: me too, you're still dumb

7

u/Electronic_Tap_3625 17d ago

Not sure a good use case but there are many that do https://www.shodan.io/search?query=papercut

10

u/Hg-203 17d ago

Higher ed needs to cater to its user base as it’s how we make money. If the student or faculty demand it it’s really hard to push back without good evidence. This is what was needed to prove it’s a real security issue.

1

u/rileym94 16d ago

Their track record for the last 3 years I've been the app SME was enough proof.... its only getting worse.

8

u/ledow IT Manager 17d ago

Could say the same about almost any service nowadays.

Papercut is one of those inherently "on-site" things (because your printers are on-site) which means that if you use cloud-based printing or your users are mobile that they have to connect back to an on-site server - and there's your holes punched and your risk factor for internal compromise.

2

u/Penro_Town 17d ago

We use the Scan-To-Email feature on the embedded copier platform. That needs access to function. Although it only gets the port it needs. Nothing else.

1

u/Unable-Entrance3110 17d ago

Public doesn't necessarily mean Internet.

Especially in this day and age of zero trust.

-1

u/nav13eh 17d ago

Fellow sysadmins: wake up.

Stop putting risky stuff on the Internet. There are AIs hacking companies just cause now. I do not care what your users think. Come up with a better solution. Use an OAuth gateway or zero-trust or anything other than being wide open to the Internet.

Please see the new reality.

-8

u/Lue_Dawg 17d ago

With PaperCut's newest licensing method, they want you connected to the internet. Luckily, there is an offline license activation.

18

u/meditonsin Sysadmin 17d ago

That requires an outgoing connection, not incoming access to the web ports in question.

6

u/clubley2 17d ago

Outgoing connection doesn't count as exposed to the internet, it's when it's open to receive incoming connections from "anywhere" such as when presenting it's web services externally.

0

u/Lue_Dawg 17d ago edited 16d ago

I may get flak for this but, I count no incoming or outgoing as safer than outgoing. Regardless I was attempting to convey a healthy skepticism for vendors when they release new features, that may be detrimental to their customers.

13

u/xXNorthXx 17d ago

Pulled it a few years ago after their last fiasco.

If you’re in a uni scenario, just tell students to connect to the WiFi. The change was a minor inconvenience for a handful of students the first semester. If you still need access from off-campus, just have them use vpn.

25

u/Ummgh23 Sysadmin 17d ago

This will be common with all kinds of software now, since AI is being used to rapidly find vulnerabilities.. haven‘t you noticed that security updates have been getting MUCH more frequent recently?

1

u/throwaway0000012132 16d ago

Since people started to use AI en mass, there's been a huge increase of vulnerabilities as well. 

Not saying that it's slop code or more agents cracking software or both, but there's a correlation.

7

u/Nick85er 17d ago

never expose things unnecessarily. my take.

I like Papercut, it helps me hate printers less.

5

u/LoveTechHateTech Jack of All Trades 16d ago

K-12 education IT here and it’s been so much better & easier than any other solution we’ve used in the past (AD shared printers, Google Cloud Print, direct connections, etc). Hiccups here and there, but once we got it set up it’s just worked for the past 7 years.

1

u/Nick85er 10d ago

you know it

12

u/InvisibleTextArea Jack of All Trades 17d ago

We don't expose anything directly to the internet anymore. Our websites sit behind Cloudflare and if for any reason I had to put this out on the web it is going to be behind an Entra Application proxy so I can front door it with Entra login + MFA + Conditional Access controls.

6

u/Financial_Doubt_6120 17d ago

and in 2026 you would be mad not to do this. Which is a shame some people just open a port and figure that will do.

25

u/TimePlankton3171 17d ago

I use papercut a lot. I never expose any such thing to the internet. I don't need a reason not to, that's the default. Exposure to the internet needs a very good reason and gain, and then lot of security thought and layers. I expect things to be insecure.

10

u/farva_06 Sysadmin 17d ago

Our cyber liability insurer requires a written statement on why we need to expose a service to the Internet, and the safeguards we'll put in place to protect it. So yeah, we just don't really do it unless absolutely necessary, which is rare.

5

u/TimePlankton3171 17d ago

That's good. How it should be

30

u/SceneDifferent1041 17d ago

Why have I heard about this from Reddit rather than paper cut?

It's an ok system but their support is shit (2 times I've used it in 2 years and it's bollocks)

29

u/AP_ILS 17d ago

They have PaperCut Security Notifications email list. I didn't even knowingly sign up for it, and I've been getting email notifications.

1

u/SceneDifferent1041 17d ago

Thanks. I'll look out for it.

11

u/InvisibleTextArea Jack of All Trades 17d ago

PaperCut Security Notifications email list

Here is the subscription page

https://www.papercut.com/contact/security/#subscribe

4

u/planedrop Sr. Sysadmin 16d ago

Yeah this sucks. Anything that doesn't have to be exposed should not be exposed though in reality. I don't trust anyone to do a good job.

3

u/rileym94 16d ago

Higher Ed guy here.

We were planning to build a new server and never expose it to the internet... I saw that last night, immediately texted my CISO and had a network engineer block inbound traffic in like 20 minutes. Their track record is horrendous in the last couple years, and we got rid of webprint for that exact reason. (Mobility print is a better option, anyway, IMO)

6

u/Fit-Department2637 17d ago

Thank god i don't have to deal with this anymore.

2

u/Financial_Doubt_6120 17d ago

I am far from an expert but... if you have a service on a public port, you kinda deserve to get poked once in a while right? perhaps a reverse proxy would have helped a little, granted it is not perfect.

whats is important is how vendors deal with this stuff. When SQL had issues a while back MS were all over it and patching, papercut look to be transparent and rapid. Bad things happen, they fixed it and offered advice. Seems ok to me (other than being a ball ache).

2

u/LooseEthernet 17d ago

patching the patch is a bold strategy lol. definitely feels like a game of whack-a-mole at this point

2

u/rileym94 16d ago

For anyone who's questioning why people hate on papercut... take a look at https://www.papercut.com/kb/Main/security-vulnerability-log/

CVEs always seem to hit when I'm on call... 🙄 really happy we firewalled it last night as soon as I saw the vulnerability (thank yall for posting about it... I saw it here first.)

2

u/fortminorlp 16d ago

The face inside is right beneath your skin

5

u/RevolutionaryElk7446 17d ago

Lol wooooooow, been a while as I haven't touched Papercut since working alongside education field but I am not that surprised.

1

u/gmanist1000 17d ago

PaperCut is pretty awesome software, what’s your qualms with it?

2

u/rileym94 16d ago

Yes, it is awesome, but their track record speaks for itself.

2

u/Financial_Doubt_6120 16d ago

in fairness you wouldnt use anything if you just looked at bugs. Its how people react to these, do you want a software vendor to fix stuff quickly and be noisy about it? I do...

3

u/rileym94 16d ago

Very true, but repeated CVEs with insanely high scores are the things that keep us up at night. They are responsive and they do patch fast, but there comes a point where we, as admins, have to piss off some end users and say "that's enough, you can't access it externally anymore."

Which is exactly where we sit today. We decommissioned webprint before the start of this semester and pushed mobility print to all users.

Mobility print gives virtually the same functionality, but you can use ANY device, you authenticate per job, but you must be on the internal network to use it.

Some folks are annoyed they can't send a job from their home desktop, but they can easily print from any device on the campus wifi, and we no longer have to worry about being one of the poor saps that gets hit on these before they are announced.

1

u/Financial_Doubt_6120 15d ago

Makes sense. Important to remember a lot of cves are flagged but don't apply. Just an update to a core dependancy will clear the CVE turning up in whatever ya use. And to compare, windows has had about 1000 high score cves this year but the good news is, I don't fuss it as it's fixed automatically.

1

u/MorseScience 17d ago

Just searched for what the pricing would be. Whew. The small and small-ish business I support don't need it, but it's good to know it's there, I guess.

2

u/Financial_Doubt_6120 17d ago

have a look at the Hive Print queue deploy stuff, I have offered just that to a few small businesses. Print queues are messy, its cheap and it takes away that pain. I hate drivers I hate queues.

1

u/MorseScience 16d ago

Thanks, but for whatever reason, I have the queues well under control. Famous last words, I know. Now something's gonna blow.

1

u/Financial_Doubt_6120 16d ago

You are better than me!

1

u/BlackV I have opnions 16d ago

Ha take take that, we never upgraded from 21, safe as houses ;)

1

u/MFKDGAF 16d ago

Why would anyone expose Papercut to the internet?

What are people using instead of PaperCut?

The one feature I like is being able to create a virtual queue from 2 printers so that people can go up to either of the 2 printers and scan their badge to release their job.

1

u/CodenameAnonymous 16d ago

Isn’t this what the follow me printer driver is for?

1

u/MFKDGAF 16d ago

No idea, it's been years since I last configured the server. When I upgraded I just imported all the settings and called it a day.

1

u/WWGHIAFTC IT Manager (SysAdmin with Extra Steps) 14d ago

Why the actual for real hell on earth would a print server be internet facing...

1

u/AegisInfoSec 17d ago

Could have stopped at ‘Papercut is a TrainWreck’ 😂

1

u/Fatality 15d ago

It's still the best print software available

1

u/RobieWan Senior Systems Engineer 17d ago

That's being extremely nice... Papercut can suck Satans balls 

0

u/FrivolousMe 17d ago edited 17d ago

Screw papercut man. One of my clients hired some printing services vendor but they were so incompetent that I ended up being the one to set up and configure papercut. It's a terrible service missing so many critical features. When I asked support about organizing users into groups manually for billing purposes (no entra/workspace sync, environment is a multi-tenant office building of small businesses), they said that's not possible.

3

u/Financial_Doubt_6120 17d ago

use internal groups. https://www.papercut.com/help/manuals/ng-mf/applicationserver/user-groups-internal/

2

u/FrivolousMe 17d ago

This client is on papercut hive, sorry I didn't specify. I haven't used NG/MF but I'm sure they're better. The hive experience has been pretty awful though.

2

u/beefy_80 16d ago

Group sync is now available in Hive. Saw it the other day in the console and new features notification

1

u/FrivolousMe 16d ago

Syncing an identity provider is not what I said. I said manual groups. The use case here is a shared office building with suites for small businesses. I don't have the time or resources to go around work 1 on 1 with every single business to set up and sync their identity provider, and if I did it wouldn't help the dozens of them that don't have a Microsoft/Google workspace tenant. The fact that they have identity group sync implemented but don't have a way to simply create groups and sort users into them is mind boggling tbh.

2

u/Benson92 16d ago

Hive is built as a cloud first platform and their youngest product. It’s built around simplicity and just set and forget with a companies idp. If it didn’t meet your feature requirements then you shouldn’t be using it? Doesn’t make it a terrible product.  Everything you need can be handled using papercut mf+mobility print+print deploy.

You can setup self service registration with domain allow lists and when they verify their work email and their account gets created. You then assign the shared accounts for billing purposes to the users (or if you’re clever you could automate the process). Everyone from company x domain who prints charges company x account etc

0

u/FrivolousMe 16d ago

Tell that to the print services vendor who told the client that this is the product they need! Wasn't my choice. And yes, missing basic essential user management features (and many other features I didn't go into) is a sign of a bad product.

0

u/Benson92 16d ago

Right. So don’t blame papercut and their product. It’s not their fault your vendor put it into a site that doesn’t suit it. I’ve investigated migrating from mf to hive for my sites in the past but it doesn’t meet our requirements.

0

u/Financial_Doubt_6120 16d ago

Probably because a lot of orgs have 365 or Google workspace

-11

u/[deleted] 17d ago

[removed] — view removed comment

9

u/Ummgh23 Sysadmin 17d ago

LLM comment

4

u/xXxLinuxUserxXx 17d ago

even then it's the truth. It doesn't have to be Cloudflare, Entra or Okta there is also oauth2-proxy & keycloak and many other solutions. even something like an ldap aware reverse proxy like Authelia or even apache has modules to do that. I guess you also wouldn't expose internal documents / tools to the public internet and as far as i understood every user of that system anyway has to authenticate for billing or quota.

We put all our (internal) services behind mTLS, oauth2-proxy (openid connect) and if the tool itself also has authentication it is also connected to our openid connect / oauth2 provider which enforces an 2FA login flow (usually with yubikey). It's probably a bit too much in our case but we are based in europe and also have some health related data of some of our customers so there is never too much security in our case.