PPapermerge

Products

Exploited and recent CVEs

• CVE-2026-110624 Low 3.1 Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all 0.3%
• CVE-2026-110623 High 7.5 Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API 0.5%
• CVE-2026-110622 High 7.5 Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints 0.5%
• CVE-2026-105314 High 7.5 Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed u 1.1%
• CVE-2025-10209 Medium 5.4 Papermerge DMS Authorization Token improper authorization 0.4%