Remote Code Execution Vulnerability in Papermerge by Papermerge
CVE-2026-105314
7.5HIGH
Key Information:
- Vendor
Papermerge
- Status
- Vendor
- CVE Published:
- 5 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-105314?
The Papermerge version 3.5.3 is susceptible to a remote code execution vulnerability due to improper handling of directory traversal within the /api/documents/upload endpoint. A standard user can exploit this flaw to write malicious Python .pth files to the site-packages directory. When the Python interpreter is restarted, it executes the code contained within these files, potentially allowing attackers to gain unauthorized access and control over the affected system.
Affected Version(s)
Papermerge 3.5.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.