PT-2026-48480 · Npm+2 · @Papra/Webhooks+1

CVE-2026-48051

·

Published

2026-06-10

·

Updated

2026-07-27

CVSS v3.1

3.5

Low

VectorAV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Papra versions prior to 26.5.0
Description The webhook delivery system contains a Server-Side Request Forgery (SSRF) protection bypass. While the system validates the registered webhook URL against a blocklist of internal addresses (including loopback, link-local, and RFC-1918 ranges), it fails to validate redirect destinations. The HTTP client ofetch automatically follows 3xx responses, allowing an authenticated organization member to register a webhook pointing to an attacker-controlled server that redirects the request to any internal address.
Technical details include:
  • Vulnerable Function: ofetch.raw() in packages/webhooks/src/webhooks.services.ts is called without a redirect option, defaulting to follow.
  • Bypass Mechanism: The SSRF checks checkWebhookUrlIsSsrfSafe and filterOutSsrfUnsafeWebhooks only validate the initial URL and not the Location header of a redirect response.
This is a blind SSRF, meaning response bodies are not exposed via the API, but internal network topology can be inferred based on request success or failure. Additionally, HTTP 307 redirects can be used to send state-changing POST requests to internal services.
Recommendations Update to version 26.5.0. As a temporary mitigation, restrict the use of the webhook delivery system for untrusted organization members.

Exploit

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-48051
GHSA-5G86-85RP-F9HX

Affected Products

@Papra/Webhooks
Papra