Papra renders the user’s display name directly into the body of its promotional and password‑reset emails without escaping any markup. The injected content appears within the HTML of the message, effectively turning a harmless announcement into a malicious link or form. The vulnerability represents a classic web‑based injection flaw (CWE‑79 and CWE‑80), allowing an attacker to craft HTML tags that are sent to real users from an email address that looks legitimate.

The Papra document management and archiving platform is affected in all releases older than version 26.4.0. The vulnerability targets the project identified as papra-hq:papra and manifests when a user registers or changes their profile name. Anyone running an unpatched copy of the software, regardless of deployment size, is exposed.

The CVSS score of 4.3 indicates moderate severity, and no EPSS data is available; KeV does not list this issue. The likely attack vector is through the public registration flow, as an attacker can create an account with a crafted display name. No additional privileges or configuration changes are required; once the account exists, each verification or reset email will carry the attacker’s embedded HTML, making the exploitation trivial and easily repeatable for a malicious actor.