{"id":"CVE-2026-105314","published":"2026-10-05T08:17:15.797","lastModified":"2026-10-06T18:16:43.707","description":"Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-24"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf","tags":[]},{"url":"https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce","tags":[]},{"url":"https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py","tags":[]},{"url":"https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py","tags":[]}],"exploitRefs":[{"url":"https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf","tags":[]},{"url":"https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce","tags":[]},{"url":"https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py","tags":[]},{"url":"https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py","tags":[]}],"hasPoc":true,"ai":{"summary":"Papermerge 3.5.3 contains a directory traversal vulnerability in its document upload API that allows authenticated users to write arbitrary Python code files to the application's site-packages directory, enabling remote code execution when the Python interpreter restarts. This represents a significant security risk as it can be exploited by standard users without elevated privileges.","exploitability":"Exploitation requires an authenticated user account and is moderately difficult due to the need for precise directory traversal payload construction, but becomes more feasible with public exploit references available.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the Papermerge server with the privileges of the application process, potentially leading to full system compromise or data exfiltration across all documents managed by the application.","remediation":"Upgrade to Papermerge 3.5.4 or later to address this directory traversal vulnerability in the document upload API.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","api","directory-traversal"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:56:46.055Z"}}