CVE Intelligence

Papermerge Papermerge vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Papermerge Papermerge: 1 record(s), with affected versions and fixes.

CVE-2026-105314 High · 7.5 CWE-24 Oct 5, 2026
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal…
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.