CVE-2026-35460 is a cross-site scripting (XSS) vulnerability in the Papra document management platform affecting versions before 26.4.0. The vulnerability arises because transactional email templates interpolate the user.name field directly into HTML email bodies without escaping or sanitization. An attacker registering with a malicious display name containing HTML tags can inject these tags into emails such as verification and password reset messages. Since these emails originate from the legitimate Papra domain, this can facilitate convincing phishing attacks. The vulnerability is classified under CWE-80 and CWE-79 and has a CVSS 3.1 base score of 4.3 (medium severity).

The vulnerability allows an attacker to inject arbitrary HTML into emails sent from Papra, potentially enabling phishing attacks that appear to come from a trusted source. This could lead to users being deceived into performing unintended actions or disclosing sensitive information. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented.

This vulnerability is fixed in Papra version 26.4.0. Users and administrators should upgrade to version 26.4.0 or later to remediate this issue. Since this is not a cloud service, patching the affected software is required. Patch status is not explicitly confirmed in vendor advisory content, but the description states the issue is fixed in 26.4.0, indicating an official fix is available.