{"id":"CVE-2026-48051","sourceIdentifier":"security-advisories@github.com","published":"2026-07-27T18:16:55.633","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0."},{"lang":"es","value":"Papra es una plataforma minimalista de gestión y archivo de documentos. Antes de la versión 26.5.0, el sistema de entrega de webhooks de Papra contiene un bypass de protección SSRF que permite a cualquier miembro autenticado de la organización hacer que el servidor realice solicitudes HTTP a direcciones internas - rangos de loopback, link-local y RFC-1918. La protección SSRF valida la URL del webhook registrado pero ignora los destinos de redirección. El cliente HTTP (ofetch) sigue las respuestas 3xx automáticamente, y el objetivo de redirección nunca se verifica contra la lista de bloqueo. Un atacante registra un webhook apuntando a un servidor controlado por el atacante, que redirige las solicitudes POST entrantes a cualquier dirección interna. La explotación fue confirmada mediante una prueba en vivo contra la imagen oficial de Docker. La solución es un cambio de una sola línea en el cliente HTTP del webhook. Este problema ha sido parcheado en la versión 26.5.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"papra-hq","product":"papra","versions":[{"version":"< 26.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-28T14:52:41.540495Z","id":"CVE-2026-48051","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx","source":"security-advisories@github.com"},{"url":"https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}