CVE-2026-35460

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from official Papra notifications. This vulnerability is fixed in 26.4.0.

• CWE-79
• CWE-80

• https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4Exploit, Vendor Advisory
• https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4Exploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35454The Code Extension Marketplace is an open-source alternative…6.5
• CVE-2026-35455immich is a high performance self-hosted photo and video man…5.4
• CVE-2026-35457libp2p-rust is the official rust language Implementation of …8.2
• CVE-2026-35458Gotenberg is an API for converting document formats. In 8.29…9.8
• CVE-2026-35459pyLoad is a free and open-source download manager written in…9.1
• CVE-2026-3546The e-shot form builder plugin for WordPress is vulnerable t…5.3
• CVE-2026-35461Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35462Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35463pyLoad is a free and open-source download manager written in…8.8
• CVE-2026-35464pyLoad is a free and open-source download manager written in…7.5
• CVE-2026-35465SecureDrop Client is a desktop app for journalists to secure…7.5
• CVE-2026-35466XSS vulnerability in cveInterface.js allows for inject HTML …6.1