CVE-2026-105314CWE-24

CVE-2026-105314

High · published October 5, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00899 · 59.2th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2026-10-05T12:17Z
References (4)
https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf · [email protected]https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce · [email protected]https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py · [email protected]https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 1%
    epss
  • 05 OCT 07:28Z
    Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
    cvelistv5