Vulnerability in Papermerge

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-p…
• github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce
• github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/rou…
• github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py