CVE-2026-105314
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.
| CWE | CWE-24 |
| Vendor | papermerge |
| Product | papermerge |
| Published | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for papermerge papermerge
Be the first to know when new high vulnerabilities affecting papermerge papermerge are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Papermerge / Papermerge
3.5.3
References
github.com: https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf github.com: https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py github.com: https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py github.com: https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce