Papermerge CVE-2026-105314

Requires a valid authenticated Papermerge account at standard (non-privileged) user level and network access to the /api/documents/upload API endpoint on a deployment running version 3.5.3. The attacker must supply a filename with directory-traversal sequences that resolves into the Python interpreter's site-packages directory, and the written file must be a .pth file whose embedded code Python auto-executes. The decisive limiting factor is timing: the payload runs only 'upon the next start of the Python interpreter,' i.e. an application/worker restart the attacker typically does not control, so exploitation is not instantaneous. Additional limiters: authentication is mandatory (not a pre-auth flaw), and success depends on the application process having write permission to site-packages (common in single-user/venv or container deployments, less so where site-packages is read-only).

This is a credible but conditionally-gated RCE. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) aligns well with the description: network-reachable API, a low-privileged ('standard user') authenticated account required (PR:L), no user interaction, and full confidentiality/integrity/availability impact consistent with arbitrary code execution. The AC:H rating is justified and important - the .pth payload does not execute on upload but only 'upon the next start of the Python interpreter,' a precondition the attacker generally does not control, which both delays and makes exploitation less deterministic. Public exploit code exists (a documented PoC with write-up), so weaponization effort is low once an attacker has a valid account. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active, widespread exploitation at time of analysis; the combination of PoC-available + authentication-required + delayed trigger points toward opportunistic/targeted risk rather than mass exploitation. Net: a real, patch-worthy priority for anyone running Papermerge 3.5.3 with multiple user accounts, but the PR:L and interpreter-restart dependency meaningfully lower real-world risk below a drive-by unauthenticated RCE. Missing signals to verify: EPSS probability and KEV status were not supplied and should be checked independently.

A standard (non-admin) Papermerge user authenticates and sends a crafted POST to /api/documents/upload whose filename contains directory-traversal sequences, causing a Python .pth file to be written into the interpreter's site-packages directory. The next time the Papermerge/Python process restarts (deploy, crash-recovery, or scheduled restart), the interpreter automatically executes the attacker's code embedded in the .pth file, yielding code execution in the application's context. A public PoC (PDF write-up and supporting files) demonstrating this arbitrary-file-write-to-RCE chain is available.