Webhook Vulnerability in Papra Document Management Platform

CVE-2026-35461

What is CVE-2026-35461?

The Papra Document Management and Archiving Platform has a vulnerability in its webhook system that permits authenticated users to register arbitrary URLs as webhook endpoints, without any validation of the URLs. This lack of validation allows for potentially malicious URLs, including those pointing to localhost, internal network addresses, or sensitive cloud provider metadata endpoints, to be registered. Upon each document event, the server sends outbound HTTP POST requests to these registered URLs, which could lead to significant security risks such as unauthorized data access or manipulation. The issue is resolved in version 26.4.0.

References