CVE-2020-29456

An attacker creates a folder, tag, or document whose name contains a JavaScript or HTML payload (e.g., `XSS Folder<script>alert('XSS');</script>`). When any user (including the attacker) opens that folder in the Papermerge web application, the browser executes the injected script [ref_id=1]. If email consumption is configured, a malicious document can be sent by email and is automatically uploaded, requiring no authentication to trigger the XSS. Otherwise, the attacker must first authenticate to the application.

The vulnerability exists in the folder creation, rename, tag, upload, and create folder functions of Papermerge. The advisory [ref_id=1] demonstrates that user-supplied folder names are not sanitized before being rendered in the browser when the folder is opened.

The advisory [ref_id=1] recommends that user input be properly validated and sanitized before being rendered in the web page, referencing OWASP XSS prevention guidance. No patch diff is provided in the bundle; the fix was released in Papermerge version 1.5.2, which neutralizes user-controllable input before it is placed in output used as a web page.

1. Log in to the Papermerge web application. 2. Create a new folder named `XSS Folder<script>alert('XSS');</script>` (without quotes). 3. Open the newly created folder. The browser executes the JavaScript payload, displaying an alert box [ref_id=1].