CVE-2026-48051

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48051", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.578Z", "datePublished": "2026-07-27T17:59:39.206Z", "dateUpdated": "2026-07-28T14:54:23.072Z"}, "containers": {"cna": {"title": "Papra: SSRF via HTTP redirect bypass in webhook delivery", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx"}], "affected": [{"vendor": "papra-hq", "product": "papra", "versions": [{"version": "< 26.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T17:59:39.206Z"}, "descriptions": [{"lang": "en", "value": "Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses \u2014 loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0."}], "source": {"advisory": "GHSA-5g86-85rp-f9hx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T14:52:41.540495Z", "id": "CVE-2026-48051", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:54:23.072Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48051", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T14:52:41.540495Z"}}}], "references": [{"url": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:52:50.222Z"}}], "cna": {"title": "Papra: SSRF via HTTP redirect bypass in webhook delivery", "source": {"advisory": "GHSA-5g86-85rp-f9hx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "papra-hq", "product": "papra", "versions": [{"status": "affected", "version": "< 26.5.0"}]}], "references": [{"url": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx", "name": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses \u2014 loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T17:59:39.206Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48051", "state": "PUBLISHED", "dateUpdated": "2026-07-28T14:54:23.072Z", "dateReserved": "2026-05-20T18:15:53.578Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-27T17:59:39.206Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "papra", "vendor": "papra-hq", "versions": [{"status": "affected", "version": "< 26.5.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses \u2014 loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0."}, {"lang": "es", "value": "Papra es una plataforma minimalista de gesti\u00f3n y archivo de documentos. Antes de la versi\u00f3n 26.5.0, el sistema de entrega de webhooks de Papra contiene un bypass de protecci\u00f3n SSRF que permite a cualquier miembro autenticado de la organizaci\u00f3n hacer que el servidor realice solicitudes HTTP a direcciones internas - rangos de loopback, link-local y RFC-1918. La protecci\u00f3n SSRF valida la URL del webhook registrado pero ignora los destinos de redirecci\u00f3n. El cliente HTTP (ofetch) sigue las respuestas 3xx autom\u00e1ticamente, y el objetivo de redirecci\u00f3n nunca se verifica contra la lista de bloqueo. Un atacante registra un webhook apuntando a un servidor controlado por el atacante, que redirige las solicitudes POST entrantes a cualquier direcci\u00f3n interna. La explotaci\u00f3n fue confirmada mediante una prueba en vivo contra la imagen oficial de Docker. La soluci\u00f3n es un cambio de una sola l\u00ednea en el cliente HTTP del webhook. Este problema ha sido parcheado en la versi\u00f3n 26.5.0."}], "id": "CVE-2026-48051", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48051", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T14:52:41.540495Z", "version": "2.0.3"}}]}, "published": "2026-07-27T18:16:55.633", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/papra-hq/papra/security/advisories/GHSA-5g86-85rp-f9hx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "papra", "source": "cna", "vendor": "papra-hq"}, "product": "papra", "vendor": "papra-hq"}], "created": "2026-07-28T02:30:04.244454+00:00", "updated": "2026-08-03T17:15:12.647644+00:00", "vendors": ["papra-hq", "papra-hq$PRODUCT$papra"]}