Cross-Site Scripting in Papra Document Management System

CVE-2026-35460

What is CVE-2026-35460?

Papra, a minimalistic document management and archiving platform, has a vulnerability that affects its handling of user input in transactional email templates. Prior to version 26.4.0, Papra interpolated user.display_name directly into the HTML of verification and password reset emails without proper escaping or sanitization. This flaw allows attackers to register with a display name containing HTML tags, enabling the injection of these tags into emails. Consequently, users may receive seemingly legitimate emails from official Papra domains, resulting in potential phishing attacks that can deceive recipients into taking harmful actions.

References