Papra’s webhook system, before version 26.4.0, allows authenticated users to register any URL as a webhook without validating the destination. When a document event occurs, the server automatically posts to those URLs, which can include internal network ranges, localhost, or cloud metadata services. The vulnerability is performed in a blind fashion: the attacker cannot see the response from the target, but can cause the server to reach internal or metadata endpoints, potentially exposing privileged information or enabling further exploitation. The weakness is identified as CWE‑918.

The affected product is Papra, a document management and archiving platform. The vulnerability exists in all releases prior to 26.4.0.

The CVSS score is 5, indicating moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no known public exploits at this time. The attack vector requires an authenticated user to register a webhook, after which the server performs outbound POST requests. Once a malicious webhook URL has been registered, any subsequent document event will trigger an outbound request to the attacker‑controlled endpoint, allowing the attacker to probe internal resources or access cloud metadata. The risk to confidentiality and availability depends on the internal environment accessed through the blind SSRF.