EUVD-2026-40142
GHSA-4cq7-5c7c-cc5r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint needing no attacker privileges but requiring victim interaction; C:L reflects credentialed response reading noted in description and disclosure tags.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint reflecting arbitrary request Origins with Access-Control-Allow-Credentials set to true. Attackers can lure authenticated victims to malicious pages that silently issue credentialed cross-origin requests to upload arbitrary files into victim datarooms and read credentialed responses.
AnalysisAI
CORS misconfiguration in Papermark through version 0.22.0 enables unauthenticated remote attackers to silently perform credentialed cross-origin file uploads into authenticated victims' datarooms and read credentialed server responses. The TUS-based viewer upload endpoint reflects arbitrary caller Origins while returning Access-Control-Allow-Credentials: true, violating the fundamental CORS security contract and allowing any attacker-controlled webpage to abuse a victim's active session. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; exploitation is constrained by the requirement for victim user interaction.
Technical ContextAI
Papermark is an open-source document sharing and dataroom platform built around secure file distribution. The vulnerability resides specifically in its TUS (tus.io) resumable file upload endpoint used by document viewers. TUS is an HTTP-based open protocol for reliable, resumable uploads. The root cause, classified as CWE-942 (Permissive Cross-domain Policy with Untrusted Domains), is the server dynamically echoing the caller's Origin request header verbatim into the Access-Control-Allow-Origin response header while simultaneously returning Access-Control-Allow-Credentials: true. Per the CORS specification, this combination allows any arbitrary website to issue authenticated cross-origin requests using the victim's browser-held session cookies or tokens, completely bypassing the same-origin policy for this endpoint. No formal NVD CPE string is enumerated; the affected version ceiling of 0.22.0 is confirmed by the CVE description and corroborated by upstream issue tracker references.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis; the fix exists only as a pull request on a fork (github.com/AstoKr/papermark/pull/1) and has not been merged into a tagged upstream release - operators should monitor github.com/papermark/papermark/issues/2178 for patch availability. As an immediate compensating control, configure a reverse proxy (nginx, Caddy, or equivalent) in front of Papermark to intercept responses from the TUS viewer upload endpoint and replace the reflected Access-Control-Allow-Origin header with a strict static allowlist of trusted domains, and remove or set Access-Control-Allow-Credentials to false; the trade-off is that this may break intentional cross-origin viewer upload flows if any are in use. Alternatively, restricting network access to the TUS upload endpoint to internal or VPN-only IP ranges prevents external exploitation entirely, at the cost of blocking legitimate external viewer upload access. Full advisory details are published by VulnCheck at vulncheck.com/advisories/papermark-cors-misconfiguration-in-viewer-upload-endpoint.
More in Cors Misconfiguration
View allCross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` co
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today