SSRF Protection Bypass in Papra Document Management System
CVE-2026-48051

3.5LOW

Key Information:

Vendor

Papra-hq

Status
Papra
Vendor
CVE Published:
27 July 2026

What is CVE-2026-48051?

The Papra Document Management System, a minimalistic platform for document management and archiving, has a critical vulnerability prior to version 26.5.0. This vulnerability arises from a bypass in its webhook delivery system's protection against Server-Side Request Forgery (SSRF). Authenticated members of an organization can exploit this flaw to make HTTP requests to internal addresses, including loopback and link-local networks. The issue occurs because while the registered webhook URL is validated, the system overlooks the redirect destinations, allowing an attacker to register a malicious webhook that redirects requests to an internal resource. Exploitation has been demonstrated through live tests on the official Docker image. A patch has been introduced in version 26.5.0, addressing this vulnerability with a simple modification to the webhook's HTTP client.

Affected Version(s)

papra < 26.5.0

References

https://github.com/papra-hq/papra/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.