CVE-2026-35460: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected...