CVE-2026-105314

Published 5 October 2026 · tracked since 5 October 2026

Description

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-59783
• CVE-2026-105289 LOW 3.5
• CVE-2026-105290 HIGH 7.3
• CVE-2026-105291 MEDIUM 4.3
• CVE-2026-105287 MEDIUM 6.3
• CVE-2026-105288 MEDIUM 4.3
• CVE-2026-105263 MEDIUM 4.7
• CVE-2026-105253 HIGH 7.3
• CVE-2026-105254 MEDIUM 6.3
• CVE-2026-104807

→ Open the live CVE board · all tools