Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint reflecting arbitrary request Origins with Access-Control-Allow-Credentials set to true. Attackers can lure authenticated victims to malicious pages that silently issue credentialed cross-origin requests to upload arbitrary files into victim datarooms and read credentialed responses.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57957
- 2026-10-03 Alias added: GHSA-4cq7-5c7c-cc5r
References
More papermark vulnerabilities
- TI-2025-35601 Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated… CVSS 3.1MEDIUM 6.5
- TI-2026-75084 Missing authorization in Papermark data room viewer group API CVSS 4.0LOW 2.3
Sources
- CVE-2026-57957 · CVE Program
- CVE-2026-57957 · NVD
- FIRST EPSS
- GHSA-4cq7-5c7c-cc5r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences