Papermerge vulnerabilities
We track 3 vulnerabilities in Papermerge products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Papermerge vulnerabilities
- 7.5 High severity
papermerge-core: Missing Authorization
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes
- 7.5 High severity
papermerge-core: Missing Authorization
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /p
- 7.5 High severity
Papermerge: Path Traversal: '../filedir'
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.