Papermark versions up to 0.22.0 have a CORS misconfiguration vulnerability allowing unauthenticated attackers to perform credentialed cross-origin requests via the TUS-based viewer upload endpoint. This misconfiguration reflects arbitrary Origins with Access-Control-Allow-Credentials set to true, enabling attackers to trick authenticated users into uploading arbitrary files to victim datarooms and reading credentialed responses.