CVE-2026-105314 Papermerge CVE debrief

Who should care

Defenders responsible for Papermerge instances, particularly those with standard user access, should assess exposure and potential impact. They should verify exposure by checking if the Papermerge instance is vulnerable to directory traversal attacks and assess potential impact by evaluating the privileges of standard users. Additionally, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor

Why it matters

CVE-2026-105314 is a high-severity vulnerability in Papermerge 3.5.3 that allows remote code execution by a standard user via directory traversal. Defenders should prioritize verifying exposure and assessing potential impact.

• Remote code execution can lead to unauthorized access and control of the system
• Standard users can exploit the vulnerability, potentially leading to lateral movement
• The vulnerability can be used to execute arbitrary code, potentially leading to data breaches or system compromise
• Verification of exposure and impact is necessary to prioritize remediation efforts

Technical summary

The vulnerability allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter. This can lead to unauthorized access and control of the system, potentially resulting in data breaches or system compromise. The vulnerability can be used to execute arbitrary code, potentially leading to lateral movement and system compromise. Defenders should prioritize verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, as the vulnerability allows remote code execution.

Recommended defensive actions

• Verify exposure by checking if the Papermerge instance is vulnerable to directory traversal attacks
• Assess potential impact by evaluating the privileges of standard users
• Implement compensating controls, such as restricting access to the /api/documents/upload endpoint
• Monitor for suspicious activity and exception tracking
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. The vulnerability allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter. Defenders should verify exposure by checking if the Papermerge instance is vulnerable to directory traversal attacks and assess potential impact by

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.