TI-2026-35493 Aliases CVE-2026-48051 GHSA-5g86-85rp-f9hx

Papra: SSRF via HTTP redirect bypass in webhook delivery

MEDIUM 50CWE-918Published 2026-07-27 · Updated 2026-07-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00255 17th percentileScored 2026-11-07

Fix Fixed papra (papra-hq): 26.5.0@papra/webhooks (npm): 0.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
papra-hq	papra	before 26.5.0	26.5.0	Patch available	CNA
—	@papra/webhooks (npm)	before 0.3.3	0.3.3	Patch available	GHSA-5g86-85rp-f9hx

papra Vendorpapra-hq Affected before 26.5.0 Fixed in 26.5.0 Patch available CNA
@papra/webhooks (npm) Vendor— Affected before 0.3.3 Fixed in 0.3.3 Patch available GHSA-5g86-85rp-f9hx

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:papra:papra::::::::	—	—	papra-hq

cpe:2.3:a:papra:papra:*:*:*:*:*:*:*:* Versions — — ·papra-hq

Remediation

Fix · CNA papra (papra-hq) Fixed in 26.5.0
Fix · GHSA-5g86-85rp-f9hx @papra/webhooks (npm) Fixed in 0.3.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-48051
2026-10-03 Alias added: GHSA-5g86-85rp-f9hx

References

Other 3

TI-2026-27590 Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name CVSS 3.1MEDIUM 5.4
TI-2026-27591 Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL CVSS 3.1MEDIUM 5.0
TI-2026-27592 Papra Does Not Reject Expired API Keys CVSS 3.1MEDIUM 4.3
TI-2026-35494 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences