Description
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Papermerge Papermerge
Default version status: unknown
3.5.3affected
pkg:pypi/papermerge-coreReferences
- https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf ↗
- https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py ↗
- https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py ↗
- https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce ↗