# CVE-2023-39143: PaperCut - Path Traversal

> Live exploitation tracking for CVE-2023-39143 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-39143

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** PaperCut
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).

## CrowdSec analysis

[CVE-2023-39143](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-39143) is a critical path traversal vulnerability in PaperCut NG and PaperCut MF on Windows systems prior to version 22.1.3. This flaw allows remote attackers to upload, read, or delete arbitrary files, and can lead to remote code execution when external device integration is enabled—a common setup. Exploitation of this vulnerability could result in full system compromise, making it a significant threat to affected organizations.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-39143 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending requests to URLs containing `/custom-report-example/..\\..\\..\\` to perform path traversal and access arbitrary files on vulnerable PaperCut servers.

## Timeline

- 2023-08-04: CVE Published. CVE-2023-39143 is published to NVD.
- 2026-04-08: Rule Released. CrowdSec releases a rule to detect CVE-2023-39143 exploitation attempts against the CrowdSec Network.

## References

- https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/
- https://www.papercut.com/kb/Main/securitybulletinjuly2023/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39143.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-39143) follows observed exploitation activity for CVE-2023-39143. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.