CVE-2026-48051— Papra: SSRF via HTTP redirect bypass in webhook delivery
Possible ATT&CK Techniques 2AI
T1557 · Adversary-in-the-Middle T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48051
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Papra: SSRF via HTTP redirect bypass in webhook delivery
Source: CVE Program / CVE List V5
Vulnerability Description
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-48051
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48051
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48051 (1)
IV. Related Vulnerabilities
Same weakness: CWE-918
- CVE-2026-53500
Thumbor treats ALLOWED_SOURCES string patterns as unescaped - CVE-2026-57232
Contao: Server-Side Request Forgery (SSRF) via Unvalidated R - CVE-2026-54725
vault-addr annotation SSRF -- webhook makes outbound HTTP ca - CVE-2026-54729
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF - CVE-2026-59231
Server-Side Request Forgery in Pentestify PDF export via unv
V. Comments for CVE-2026-48051
No comments yet