CVE-2026-57957

Name of the Vulnerable Software and Affected Versions Papermark versions prior to 0.22.1

Description A cross-origin resource sharing (CORS) misconfiguration exists in the TUS-based viewer upload endpoint. This occurs because the endpoint reflects arbitrary request Origins while the Access-Control-Allow-Credentials header is set to true. An unauthenticated remote attacker can exploit this to lure authenticated users to malicious pages, enabling the silent issuance of credentialed cross-origin requests to upload arbitrary files into the victim's datarooms and read the resulting credentialed responses.

Recommendations Update Papermark to a version newer than 0.22.0. Restrict access to the TUS-based viewer upload endpoint to minimize the risk of exploitation.