Vulnerability · Published Oct 5, 2026 · Assigned by mitre
CVE-2026-105314
High 7.5
In plain English
A high-severity security flaw in Papermerge from Papermerge. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Papermerge | Papermerge | 3.5.3 |
Weakness: CWE-24 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf exploit, technical-description
- https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py technical-description
- https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py technical-description
- https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce