CVE-2026-48051 in Papra
Summary
by MITRE • 07/27/2026
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability identified in Papra prior to version 26.5.0 represents a critical server-side request forgery flaw that undermines the platform's security boundaries and exposes internal network resources to authenticated users. This vulnerability specifically targets the webhook delivery system, which is designed to allow external services to receive notifications when certain events occur within the document management platform. The security mechanism intended to prevent unauthorized access to internal addresses through SSRF protection has been bypassed due to a fundamental design flaw in how redirect responses are handled by the underlying HTTP client implementation.
The technical root cause of this vulnerability lies in the improper validation logic of the webhook system's HTTP client component. While the platform correctly validates the initial webhook URL against a blocklist that should prevent connections to loopback, link-local, and RFC-1918 address ranges, the protection mechanism fails to account for HTTP redirects that occur during the request lifecycle. The ofetch HTTP client library automatically follows 301, 302, and other redirect responses without revalidating the final destination against the security constraints. This creates a pathway where authenticated users can register webhooks pointing to attacker-controlled servers that respond with redirects to internal addresses, effectively circumventing the intended protection measures.
The operational impact of this vulnerability is significant as it grants any authenticated organization member the ability to probe and potentially exploit internal network services without requiring privileged access or special authentication credentials. Attackers can leverage this flaw to conduct reconnaissance activities by mapping internal network topology, identifying running services, and potentially accessing sensitive internal systems that might not be properly protected. The vulnerability's exploitation has been confirmed through live testing against the official Docker image, demonstrating its practical applicability in real-world scenarios where Papra instances are deployed in containerized environments.
The security implications extend beyond simple information disclosure as this vulnerability could potentially enable more sophisticated attacks including service enumeration, internal system compromise, or even lateral movement within network environments. The bypass affects the core security principle of network isolation that should protect internal infrastructure from external access attempts. From a threat modeling perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) and maps to ATT&CK technique T1071.004 Application Layer Protocol: Web Protocols where adversaries exploit web application vulnerabilities to gain unauthorized access to internal resources.
The remediation implemented in version 26.5.0 addresses this specific vulnerability through a targeted fix that modifies the webhook HTTP client behavior to prevent automatic redirect following and ensure that all destination URLs are validated against the blocklist regardless of whether they are reached directly or through redirect chains. This single-line change effectively closes the bypass by requiring explicit validation of redirect targets, thereby maintaining the security boundaries established by the original protection mechanisms. The fix demonstrates the importance of comprehensive input validation in network security implementations and highlights how seemingly minor implementation details can create significant security vulnerabilities.
Organizations using Papra should prioritize immediate upgrade to version 26.5.0 or later to mitigate this vulnerability, while also considering broader security measures such as network segmentation, firewall rules, and monitoring for unusual webhook activity patterns. The vulnerability serves as a reminder of the critical importance of validating all network communications, including those that occur as part of normal redirect processing, and underscores the need for security controls that remain effective across the entire request lifecycle rather than just at initial entry points.