{"id":"CVE-2026-105314","revision":"37cc7b2104a8415fb5cfd98494f9cd21","records":[{"revision":"37cc7b2104a8415fb5cfd98494f9cd21","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105314","aliases":[],"title":"Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpr…","description":"Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.","state":0,"publishedAt":"2026-10-05T07:28:30.062+00:00","modifiedAt":"2026-10-06T17:41:46.323+00:00","affected":[{"ecosystem":"https://pypi.org","name":"papermerge-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://pypi.org\",\n                    \"defaultStatus\": \"unknown\",\n                    \"packageName\": \"papermerge-core\",\n                    \"packageURL\": \"pkg:pypi/papermerge-core\",\n                    \"product\": \"Papermerge\",\n                    \"programFiles\": [\n                        \"papermerge/core/features/document/router.py\",\n                        \"papermerge/core/pathlib.py\",\n                        \"papermerge/storage/backends/local.py\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"upload_document\"\n                        },\n                        {\n                            \"name\": \"docver_path\"\n                        },\n                        {\n                            \"name\": \"LocalBackend.upload\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/papermerge/papermerge-core\",\n                    \"vendor\": \"Papermerge\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3.5.3\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf","https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py","https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py","https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105314","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105314","identifiers":["CVE-2026-105314"]},"retained":false,"historicalAffected":[]}],"coverage":[]}