Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. Paper! It still exists. We have
Summary from watchTowr Labs.
Explained
The technology and terms in this story. Learn more
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-305Authentication bypass by primary weakness
- CWE-470Use of Externally-Controlled input to select classes or code ('unsafe reflection')
- CWE-78Improper neutralization of special elements used in an OS command ('OS command injection')
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.