MEDIUM
Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL
Published Apr 7, 2026
5.0
MEDIUMCVSS 3.1
EPSS 0.30%
Description
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.
Affected products
-
Affected
- < 26.4.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19655 Advisory
- https://github.com/papra-hq/papra/security/advisories/GHSA-cjw7-qg95-58mq exploitx_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19655 | Advisory | |
| https://github.com/papra-hq/papra/security/advisories/GHSA-cjw7-qg95-58mq | exploitx_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Apr 7, 2026
Updated Apr 9, 2026
Reserved Apr 2, 2026
Link CVE-2026-35461
CISA Vulnrichment
Updated Apr 9, 2026
Red Hat
No data
GitHub
No data