CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

Affected

Papermerge

CVSS v3.1 MITRE

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.90% chance of exploitation in the next 30 days, 59th percentile

Published

2026-10-05

Updated

2026-10-06

Proof-of-concept exploits (2)

• kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-cor…1★ · 2026-10-06
• kashishtopi/CVE-2026-1053140★ · 2026-10-05

References

• CVE Record
• NVD entry

Related

• CVE-2026-107449
• CVE-2026-107450
• CVE-2026-108980