CVE-2026-57957 Details
Description
Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint reflecting arbitrary request Origins with Access-Control-Allow-Credentials set to true. Attackers can lure authenticated victims to malicious pages that silently issue credentialed cross-origin requests to upload arbitrary files into victim datarooms and read credentialed responses.
A CORS misconfiguration vulnerability has been identified in Papermark versions through 0.22.0. This vulnerability allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint. The issue arises because the endpoint reflects arbitrary request origins while allowing credentials, enabling attackers to upload files to victims' datarooms by luring them to malicious pages.
To address this vulnerability, restrict the 'Access-Control-Allow-Origin' header to a specific allowlist of trusted domains, or remove 'Access-Control-Allow-Credentials' if not needed for cross-origin requests to this endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AstoKr/papermark/pull/1 | [email protected] | Issue TrackingVendor |
| https://github.com/papermark/papermark/issues/2178 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/papermark-cors-misconfiguration-in-viewer-upload-endpoint | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AstoKr Papermark | <= 0.22.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |