Papermark through version 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability (CWE-942) in its TUS-based viewer upload endpoint. The endpoint reflects arbitrary request Origins in the Access-Control-Allow-Origin header while setting Access-Control-Allow-Credentials to true. This allows unauthenticated remote attackers to exploit credentialed cross-origin requests by luring authenticated victims to malicious web pages. These pages can silently issue requests that upload arbitrary files into the victim's datarooms and read credentialed responses, potentially compromising data confidentiality and integrity.

The vulnerability enables attackers to perform credentialed cross-origin requests without authentication, potentially allowing unauthorized file uploads into victim datarooms and access to sensitive responses. This could lead to unauthorized data manipulation or disclosure within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing the vulnerable endpoint to untrusted origins and consider implementing stricter CORS policies or disabling the TUS-based viewer upload endpoint if feasible.