PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48051 papra-hq CVE debrief

CVE-2026-48051 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in Papra's webhook delivery system. An authenticated organization member can exploit this issue to cause the server to make HTTP requests to internal addresses, including loopback, link-local, and RFC-1918 ranges. The vulnerability arises because the SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client follows 3xx responses automatically without checking the redirect target against the blocklist. Exploitation involves registering a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. This issue was patched in version 26.5.0 with a single-line change to the webhook HTTP client.

Vendor
papra-hq
Product
papra
CVSS
LOW 3.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Users of Papra version prior to 26.5.0 should apply the patch to prevent potential SSRF attacks. This includes any organization using Papra's document management and archiving platform.

Technical summary

The vulnerability exists in Papra's webhook delivery system, specifically in the SSRF protection mechanism which does not account for redirects when validating URLs. An attacker can register a webhook with a URL that redirects to an internal address, allowing them to bypass SSRF protections. The fix involves modifying the webhook HTTP client to properly handle redirects. This issue was patched in version 26.5.0 with a single-line change to the webhook HTTP client. Users of Papra version prior to 26.5.0 should apply the patch to prevent potential SSRF attacks.

Defensive priority

Medium

Recommended defensive actions

  • Apply the patch by upgrading to Papra version 26.5.0 or later
  • Review and restrict webhook registrations to trusted sources
  • Monitor server logs for unusual HTTP requests to internal addresses
  • Implement additional SSRF protections if possible
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-27T18:16:55.633Z and has not been modified since then. The NVD entry is currently 3.5 (Low). Limited details are available about the specific technical nature of the vulnerability and its exploitation.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T18:16:55.633Z and has not been modified since then.