Read the docs
TI-2026-27591 Aliases CVE-2026-35461

Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL

Priority MEDIUM 56CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed papra (papra-hq): 26.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
papra-hqpaprabefore 26.4.026.4.0Patch availableCNA
  • papra Vendorpapra-hq Affected before 26.4.0 Fixed in 26.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:papra:papra:*:*:*:*:*:*:*:*before 26.4.0Vulnerablepapra-hq
  • cpe:2.3:a:papra:papra:*:*:*:*:*:*:*:* Versions before 26.4.0 Vulnerable ·papra-hq

Remediation

  • Fix · CNA papra (papra-hq) Fixed in 26.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35461

References

Exploit 1

  • TI-2026-27590 Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name CVSS 3.1MEDIUM 5.4
  • TI-2026-27592 Papra Does Not Reject Expired API Keys CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences