CVE-2026-57957: Papermark CORS Misconfiguration Vulnerability

CVE-2026-57957 Overview

CVE-2026-57957 is a cross-origin resource sharing (CORS) misconfiguration in Papermark through version 0.22.0. The TUS-based viewer upload endpoint reflects arbitrary request Origin headers while setting Access-Control-Allow-Credentials to true. This allows unauthenticated remote attackers to issue credentialed cross-origin requests from attacker-controlled pages. When an authenticated victim visits a malicious page, the browser silently sends credentialed requests that can upload arbitrary files into the victim's datarooms and read the credentialed responses. The weakness is tracked under CWE-942: Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
Authenticated Papermark users visiting a malicious page can have arbitrary files written to their datarooms and have credentialed API responses exfiltrated to attacker-controlled origins.

Affected Products

Papermark through version 0.22.0
Self-hosted Papermark deployments exposing the TUS viewer upload endpoint
Any Papermark instance using the default CORS configuration for the viewer upload path

Discovery Timeline

2026-06-29 - CVE-2026-57957 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-57957

Vulnerability Analysis

Papermark exposes a TUS (Tus Resumable Upload Protocol) endpoint used by document viewers to upload files into datarooms. The endpoint implements CORS in a way that reflects any Origin header value back in the Access-Control-Allow-Origin response header while also returning Access-Control-Allow-Credentials: true. Under this configuration, browsers permit cross-origin requests to carry session cookies and read the responses. An attacker hosting a malicious page can script fetch or XMLHttpRequest calls to the Papermark upload endpoint. Any authenticated victim who loads the page becomes an unwitting proxy for those requests.

Root Cause

The root cause is a permissive CORS policy on the viewer upload endpoint. Instead of validating the Origin header against an allowlist of trusted domains, the server echoes the requester's origin. Combined with Access-Control-Allow-Credentials: true, this defeats the same-origin policy protections that browsers normally enforce for authenticated sessions.

Attack Vector

Exploitation requires user interaction: an authenticated Papermark user must visit an attacker-controlled page. That page issues credentialed cross-origin requests to the TUS upload endpoint, uploading attacker-chosen content into the victim's dataroom and reading response bodies that include session-scoped metadata. See the VulnCheck Security Advisory, the GitHub Issue Report, and the GitHub Pull Request for protocol-level details.

No verified public exploit code is available. The vulnerability mechanism is described in prose in the referenced advisories.

Detection Methods for CVE-2026-57957

Indicators of Compromise

HTTP responses from the Papermark TUS viewer upload endpoint containing an Access-Control-Allow-Origin value that mirrors the request Origin and an Access-Control-Allow-Credentials: true header.
Upload requests to the viewer upload endpoint with Origin headers that do not match the deployment's canonical domain.
Unexpected files appearing in user datarooms with Referer headers pointing to third-party or unknown origins.

Detection Strategies

Inspect web server and reverse proxy logs for TUS upload requests whose Origin header differs from the Papermark application host.
Correlate upload events with authenticated session activity to identify uploads triggered without corresponding user navigation to the Papermark UI.
Deploy WAF or API gateway rules that flag credentialed cross-origin requests to /api/* upload paths.

Monitoring Recommendations

Enable verbose access logging on the Papermark upload endpoint including Origin, Referer, and response CORS headers.
Alert on new file creations in datarooms occurring outside normal user session activity windows.
Monitor for spikes in TUS POST/PATCH requests from user agents whose Origin does not match approved domains.

How to Mitigate CVE-2026-57957

Immediate Actions Required

Upgrade Papermark to a version later than 0.22.0 that includes the CORS fix once released by the maintainers.
Place Papermark behind a reverse proxy that strips or rewrites Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers for the viewer upload endpoint.
Instruct authenticated users to sign out of Papermark when not actively using it, reducing the window for credentialed CSRF-style abuse.

Patch Information

Refer to the upstream GitHub Pull Request and the GitHub Issue Report for the fix that replaces origin reflection with an explicit allowlist. Deploy the patched build to all self-hosted Papermark instances and confirm the upload endpoint no longer reflects arbitrary origins.

Workarounds

Configure the reverse proxy or CDN to enforce an allowlist of trusted origins on the viewer upload endpoint, rejecting requests where Origin does not match.
Remove Access-Control-Allow-Credentials: true from the upload endpoint response if credentialed cross-origin access is not required.
Restrict access to the Papermark instance via network controls or SSO enforcement until the patched version is deployed.

bash

# Example nginx snippet enforcing an origin allowlist on the upload endpoint
map $http_origin $cors_allow_origin {
    default "";
    "https://papermark.example.com" $http_origin;
}

location /api/file/tus {
    add_header Access-Control-Allow-Origin $cors_allow_origin always;
    add_header Access-Control-Allow-Credentials "true" always;
    if ($cors_allow_origin = "") { return 403; }
    proxy_pass http://papermark_backend;
}