CVE-2026-105314 PUBLISHED

Assigner: mitre
Reserved: 05.10.2026 Published: 05.10.2026 Updated: 05.10.2026

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Papermerge
Product	Papermerge
Versions	Default: unknown Version 3.5.3 is affected

References

https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf
https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py
https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py
https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce

Problem Types

CWE-24 Path Traversal: '../filedir' CWE