CyberRota Analysis
AI-GeneratedPapermerge 3.5.3 is vulnerable to remote code execution due to a directory traversal flaw in the /api/documents/upload endpoint, allowing standard users to write malicious Python .pth files to the site-packages directory. This can lead to arbitrary code execution the next time the Python interpreter is started. Organizations using this version of Papermerge should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.