Vulnerabilidades de Papermerge
CVEs publicadas que afetam produtos de Papermerge: 4 registro(s), com severidade, exploração e correções.
CVE-2026-110624
Baixa · 3.1
CWE-862 14/10/2026
Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
CVE-2026-110623
Alta · 7.5
CWE-862 14/10/2026
Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
CVE-2026-110622
Alta · 7.5
CWE-862 14/10/2026
Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVE-2026-105314
Alta · 7.5
CWE-24 05/10/2026
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal…
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.