CVE-2026-48051 Details
Description
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.
A server-side request forgery (SSRF) protection bypass vulnerability has been identified in Papra, a document management and archiving platform, in versions prior to 26.5.0. This vulnerability allows authenticated organization members to manipulate the server into making HTTP requests to internal addresses, including loopback, link-local, and RFC-1918 ranges. The issue arises because the webhook URL validation process does not account for redirect destinations. As a result, an attacker can register a webhook that redirects to an internal address, effectively bypassing the application's SSRF protections.
Users can update to Papra version 26.5.0, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Papra | <= 26.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |