CVE-2025-57682: Path Traversal
Published Sep 22, 2025
·Updated
Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution via the "POST /api/file/s3/get-presigned-get-url-proxy" API
Affected Software
2 affected components
Papermark Papermark<0.20.0
Papermark Papermark<=0.20.0
Event History
Sep 22, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-57682?
CVE-2025-57682 has a high severity rating due to its potential for unauthorized access to sensitive files.
2
How do I fix CVE-2025-57682?
To fix CVE-2025-57682, upgrade to Papermark version 0.20.1 or later, which addresses this vulnerability.
3
Who is impacted by CVE-2025-57682?
Authenticated users of Papermark version 0.20.0 and earlier are impacted by CVE-2025-57682.
4
What does CVE-2025-57682 allow attackers to do?
CVE-2025-57682 allows authenticated attackers to retrieve arbitrary files from an S3 bucket via a specific API.
5
Is CVE-2025-57682 a critical vulnerability?
Yes, CVE-2025-57682 is considered critical because it can lead to unauthorized data exposure.