CVE-2025-57682

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution via the "POST /api/file/s3/get-presigned-get-url-proxy" API

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-57682Third Party Advisory
https://github.com/mfts/papermarkProduct
https://papermark.com/Product

Timeline

Published: Sep 22, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-576858.8The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, an CVE-2025-57696.1The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encodi CVE-2025-576926.8PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of CVE-2025-576976.5AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defin CVE-2025-576987.5AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/i CVE-2025-576998.4Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user w CVE-2025-57706.1A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of outpu CVE-2025-577006.1DIAEnergie - Stored Cross-site Scripting CVE-2025-577016.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577026.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577036.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577045.5Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerabili