Skip to content
OpenAdvisories

Vendor

papermerge

5 known vulnerabilities.

Products

papermerge-core 3 Papermerge 1 DMS 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-110623

    Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

    Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-node…

    papermerge papermerge-core
  • High 7.5
    CVE-2026-110622

    Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints

    Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /…

    papermerge papermerge-core
  • High 7.5
    CVE-2026-105314 Public exploit

    Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload cal…

    papermerge Papermerge