CVE-2026-48051

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.

• CWE-918

• https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx
• https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx

Published

Jul 27, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48045Zeroconf is a pure Python implementation of multicast DNS se…6.5
• CVE-2026-48046Streambert is a cross-platform Electron Desktop App to strea…9.3
• CVE-2026-48047XWiki Platform WebJars API is a package for XWiki, a generic…5.9
• CVE-2026-48048XWiki Platform is a generic wiki platform. XWiki discovered …7.5
• CVE-2026-48049@hapi/inert provides static file and directory handlers for …5.3
• CVE-2026-4805The Woostify plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2026-48052Papra is a minimalistic document management and archiving pl…5.4
• CVE-2026-48054OpenZeppelin Contracts Wizardis a web application to interac…8.8
• CVE-2026-48055Streambert is a cross-platform Electron Desktop App to strea…10
• CVE-2026-48056Streambert is a cross-platform Electron Desktop App to strea…10
• CVE-2026-48058nebula-mesh is a self-hosted control plane for Slack Nebula …4.6
• CVE-2026-48059Netty is a network application framework for development of …7.5