CVE-2026-35460

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35460", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T19:25:52.193Z", "datePublished": "2026-04-07T14:26:52.943Z", "dateUpdated": "2026-04-07T15:59:07.465Z"}, "containers": {"cna": {"title": "Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4"}], "affected": [{"vendor": "papra-hq", "product": "papra", "versions": [{"version": "< 26.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T14:26:52.943Z"}, "descriptions": [{"lang": "en", "value": "Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from official Papra notifications. This vulnerability is fixed in 26.4.0."}], "source": {"advisory": "GHSA-6f8x-2rc9-vgh4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T15:13:13.038044Z", "id": "CVE-2026-35460", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T15:59:07.465Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35460", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T15:13:13.038044Z"}}}], "references": [{"url": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T15:13:21.174Z"}}], "cna": {"title": "Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name", "source": {"advisory": "GHSA-6f8x-2rc9-vgh4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "papra-hq", "product": "papra", "versions": [{"status": "affected", "version": "< 26.4.0"}]}], "references": [{"url": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4", "name": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from official Papra notifications. This vulnerability is fixed in 26.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T14:26:52.943Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35460", "state": "PUBLISHED", "dateUpdated": "2026-04-07T15:59:07.465Z", "dateReserved": "2026-04-02T19:25:52.193Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T14:26:52.943Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "papra", "vendor": "papra-hq", "versions": [{"status": "affected", "version": "< 26.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:papra:papra:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2F10801-36E9-47AD-AD2D-DA4709B67B72", "versionEndExcluding": "26.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from official Papra notifications. This vulnerability is fixed in 26.4.0."}], "id": "CVE-2026-35460", "lastModified": "2026-06-17T10:40:38.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35460", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T15:13:13.038044Z", "version": "2.0.3"}}]}, "published": "2026-04-07T15:17:43.887", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "papra", "source": "cna", "vendor": "papra-hq"}, "product": "papra", "vendor": "papra-hq"}], "analysis": {"en": {"generated_at": "2026-04-07T20:21:04.461230+00:00", "value": {"mitigation_remediation": ["Upgrade Papra to version 26.4.0 or later to apply the official patch.", "Verify that user display names are escaped before inclusion in email templates.", "If an immediate upgrade is not possible, restrict display names to alphanumeric characters or strip HTML tags during input processing.", "Monitor outgoing emails for unexpected HTML content and educate users about phishing indicators."], "summary": {"action": "Apply Patch", "impact": "Phishing via HTML injection in transactional emails"}, "threat_synthesis": {"affected_systems": "The Papra document management and archiving platform is affected in all releases older than version 26.4.0. The vulnerability targets the project identified as papra-hq:papra and manifests when a user registers or changes their profile name. Anyone running an unpatched copy of the software, regardless of deployment size, is exposed.", "description_and_impact": "Papra renders the user\u2019s display name directly into the body of its promotional and password\u2011reset emails without escaping any markup. The injected content appears within the HTML of the message, effectively turning a harmless announcement into a malicious link or form. The vulnerability represents a classic web\u2011based injection flaw (CWE\u201179 and CWE\u201180), allowing an attacker to craft HTML tags that are sent to real users from an email address that looks legitimate.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, and no EPSS data is available; KeV does not list this issue. The likely attack vector is through the public registration flow, as an attacker can create an account with a crafted display name. No additional privileges or configuration changes are required; once the account exists, each verification or reset email will carry the attacker\u2019s embedded HTML, making the exploitation trivial and easily repeatable for a malicious actor."}}}}, "created": "2026-04-08T19:37:30.950369+00:00", "updated": "2026-04-08T19:48:50.242447+00:00", "vendors": ["papra-hq", "papra-hq$PRODUCT$papra"]}