MEDIUM
The severity is rated as MEDIUM due to the potential for data exposure and lack of detailed security features. Real-world exploitability in homelab environments could be high if not properly secured, while production environments might have additional layers of protection such as network segmentation and access controls.

Paperwise is a self-hosted application designed to organize documents, extract metadata and perform OCR (Optical Character Recognition), and enable users to ask questions across their files. This app draws inspiration from existing projects like Paperless and Paperless-AI but offers a more integrated solution for document management and query capabilities. The system allows fine-grained control over which language model (LLM) models are used for different tasks, making it highly customizable for user-specific needs. However, the project's current state suggests that while functional, it may not be as sophisticated or robust as other established solutions like NotebookLM. Given its self-hosted nature and feature set, Paperwise could present security vulnerabilities related to data privacy, especially if sensitive documents are stored without proper encryption or access controls.

Affected Systems
  • Paperwise self-hosted application
Affected Versions: All versions
Remediation
  • Ensure that all documents stored in Paperwise are encrypted both at rest and in transit using a strong encryption standard, such as AES-256.
  • Configure access controls to limit who can view or modify documents within the application. Implement multi-factor authentication (MFA) where possible.
  • Regularly update the underlying software stack used by Paperwise, including any dependencies on OCR libraries and LLM models.
Stack Impact

In a typical homelab setup with Paperwise running alongside common document management tools like OwnCloud or Nextcloud, specific impact could include exposed documents if encryption is not implemented. Ensure that all configurations related to security settings in the Paperwise app are reviewed and tightened.

Source →