PT-2025-37087 · Unknown · Papermerge Dms

Unhingedazrael · Published 2025-09-10 · Updated 2025-09-11 · CVE-2025-10209

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Papermerge DMS versions through 3.5.3

Description: A security flaw exists in Papermerge DMS related to the Authorization Token Handler component. Manipulation of this component can lead to improper authorization. This issue can be exploited remotely, and the exploit has been publicly released. The vendor was notified but did not respond.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-10209

Affected Products

Papermerge Dms

References · 8

• 🔥 https://docs.google.com/document/d/19j0mCR-QOuhlxAJMir00Z8_MZdydVdmE_Ak09ra2NHw/edit?usp=sharing · Exploit
• 🔥 https://docs.google.com/document/d/19j0mCR-QOuhlxAJMir00Z8_MZdydVdmE_Ak09ra2NHw/edit?tab=t.0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10209 · Security Note
• https://vuldb.com/?ctiid.323482 · Note
• https://twitter.com/grok/status/1965934159081386385 · Twitter Post
• https://vuldb.com/?id.323482 · Note
• https://vuldb.com/?submit.639750 · Note
• https://twitter.com/CVEnew/status/1965920222444941814 · Twitter Post