CVE-2026-57957
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in Papermark through version 0.22.0 is caused by a CORS misconfiguration, allowing unauthenticated remote attackers to perform credentialed cross-origin requests. Attackers can exploit the TUS-based viewer upload endpoint that reflects arbitrary request Origins with Access-Control-Allow-Credentials set to true.
Risk Assessment
The risk involves potential data theft or injection of malicious files into the victim's dataroom without their knowledge. An attacker can lure an authenticated user to a malicious page that silently issues credentialed cross-origin requests to upload files and read responses.
Recommendation
It is recommended to immediately update Papermark to a version newer than 0.22.0 if available, or manually configure CORS to accept only trusted Origins and disable Access-Control-Allow-Credentials for unauthorized requests.
Other vulnerabilities in Papermark
Original NVD description (English source)
Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint reflecting arbitrary request Origins with Access-Control-Allow-Credentials set to true. Attackers can lure authenticated victims to malicious pages that silently issue credentialed cross-origin requests to upload arbitrary files into victim datarooms and read credentialed responses.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS