Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Papermerge by Papermerge
CVE-2026-105314 (GCVE-0-2026-105314)
Vulnerability from nvd – Published: 2026-10-05 07:28 – Updated: 2026-10-06 17:41
VLAI
EPSS
VEX
Summary
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:58 UTC
CWE
- CWE-24 - Path Traversal: '../filedir'
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kashishtopi/cve-pocs/blob/main… | exploittechnical-description |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/kashishtopi/cve-pocs/tree/main… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Papermerge | Papermerge |
Affected:
3.5.3
(semver)
cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105314",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:58:51.998241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:41:46.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unknown",
"packageName": "papermerge-core",
"packageURL": "pkg:pypi/papermerge-core",
"product": "Papermerge",
"programFiles": [
"papermerge/core/features/document/router.py",
"papermerge/core/pathlib.py",
"papermerge/storage/backends/local.py"
],
"programRoutines": [
{
"name": "upload_document"
},
{
"name": "docver_path"
},
{
"name": "LocalBackend.upload"
}
],
"repo": "https://github.com/papermerge/papermerge-core",
"vendor": "Papermerge",
"versions": [
{
"status": "affected",
"version": "3.5.3",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.3",
"versionStartIncluding": "3.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T07:28:30.062Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py"
},
{
"url": "https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-105314",
"datePublished": "2026-10-05T07:28:30.062Z",
"dateReserved": "2026-10-05T07:28:29.666Z",
"dateUpdated": "2026-10-06T17:41:46.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-29456 (GCVE-0-2020-29456)
Vulnerability from nvd – Published: 2020-12-02 07:50 – Updated: 2024-08-04 16:55
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.papermerge.com/ | x_refsource_MISC |
| https://github.com/ciur/papermerge/issues/228 | x_refsource_MISC |
| https://github.com/ciur/papermerge/releases/tag/v1.5.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:55:10.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.papermerge.com/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ciur/papermerge/issues/228"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ciur/papermerge/releases/tag/v1.5.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document\u0027s filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-02T07:50:23.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.papermerge.com/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ciur/papermerge/issues/228"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ciur/papermerge/releases/tag/v1.5.2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-29456",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document\u0027s filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.papermerge.com/",
"refsource": "MISC",
"url": "https://www.papermerge.com/"
},
{
"name": "https://github.com/ciur/papermerge/issues/228",
"refsource": "MISC",
"url": "https://github.com/ciur/papermerge/issues/228"
},
{
"name": "https://github.com/ciur/papermerge/releases/tag/v1.5.2",
"refsource": "MISC",
"url": "https://github.com/ciur/papermerge/releases/tag/v1.5.2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-29456",
"datePublished": "2020-12-02T07:50:23.000Z",
"dateReserved": "2020-12-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T16:55:10.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-105314 (GCVE-0-2026-105314)
Vulnerability from cvelistv5 – Published: 2026-10-05 07:28 – Updated: 2026-10-06 17:41
VLAI
EPSS
VEX
Summary
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:58 UTC
CWE
- CWE-24 - Path Traversal: '../filedir'
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kashishtopi/cve-pocs/blob/main… | exploittechnical-description |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/kashishtopi/cve-pocs/tree/main… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Papermerge | Papermerge |
Affected:
3.5.3
(semver)
cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105314",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:58:51.998241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:41:46.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unknown",
"packageName": "papermerge-core",
"packageURL": "pkg:pypi/papermerge-core",
"product": "Papermerge",
"programFiles": [
"papermerge/core/features/document/router.py",
"papermerge/core/pathlib.py",
"papermerge/storage/backends/local.py"
],
"programRoutines": [
{
"name": "upload_document"
},
{
"name": "docver_path"
},
{
"name": "LocalBackend.upload"
}
],
"repo": "https://github.com/papermerge/papermerge-core",
"vendor": "Papermerge",
"versions": [
{
"status": "affected",
"version": "3.5.3",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.3",
"versionStartIncluding": "3.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T07:28:30.062Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py"
},
{
"url": "https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-105314",
"datePublished": "2026-10-05T07:28:30.062Z",
"dateReserved": "2026-10-05T07:28:29.666Z",
"dateUpdated": "2026-10-06T17:41:46.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-29456 (GCVE-0-2020-29456)
Vulnerability from cvelistv5 – Published: 2020-12-02 07:50 – Updated: 2024-08-04 16:55
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.papermerge.com/ | x_refsource_MISC |
| https://github.com/ciur/papermerge/issues/228 | x_refsource_MISC |
| https://github.com/ciur/papermerge/releases/tag/v1.5.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:55:10.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.papermerge.com/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ciur/papermerge/issues/228"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ciur/papermerge/releases/tag/v1.5.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document\u0027s filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-02T07:50:23.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.papermerge.com/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ciur/papermerge/issues/228"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ciur/papermerge/releases/tag/v1.5.2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-29456",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document\u0027s filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.papermerge.com/",
"refsource": "MISC",
"url": "https://www.papermerge.com/"
},
{
"name": "https://github.com/ciur/papermerge/issues/228",
"refsource": "MISC",
"url": "https://github.com/ciur/papermerge/issues/228"
},
{
"name": "https://github.com/ciur/papermerge/releases/tag/v1.5.2",
"refsource": "MISC",
"url": "https://github.com/ciur/papermerge/releases/tag/v1.5.2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-29456",
"datePublished": "2020-12-02T07:50:23.000Z",
"dateReserved": "2020-12-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T16:55:10.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}