CVE-2025-57682

6.5 mediumEPSS 0.7%

Medium (6.5) in papermark papermark. EPSS 0.7% chance of exploitation in the next 30 days.

Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution via the "POST /api/file/s3/get-presigned-get-url-proxy" API

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-09-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

papermark:papermark

References

https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-57682
https://github.com/mfts/papermark
https://papermark.com/

Check your stack JSON