Remote Code Execution in Papermerge via Directory Traversal

Executive Summary

CVE-2026-105314 is a remote code execution vulnerability in Papermerge 3.5.3. It allows a standard authenticated user to upload a file with a malicious filename containing path traversal sequences (../). This bypasses intended directory restrictions and writes files outside the media root directory. If a Python .pth file is written to the site-packages directory, its code executes when the Python interpreter restarts, enabling full remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file uploads in Papermerge's media directory, especially files with path traversal sequences like ../ in filenames. Inspect Python .pth files in site-packages directories. Monitor for unexpected file writes outside the media root. Review logs for repeated upload attempts to /api/documents/upload.

Useful 0 Not Useful 0

Impact Analysis

An attacker with standard user access could upload malicious files to execute arbitrary code on the server. This could lead to data theft, system compromise, or denial of service. The attack requires only basic document-upload permissions, which are included in default user roles.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or loss of sensitive information, violating GDPR and HIPAA requirements for data protection and access controls. Compliance failures may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Disable document uploads until patched. Implement strict filename sanitization and path containment checks. Restrict file upload sizes and enforce rate limiting. Move site-packages directory outside web-accessible paths. Monitor for suspicious file writes or .pth files in Python environments.

Useful 0 Not Useful 0