Papra is a minimalistic document management and archiving platform that, before version 26.5.0, contained an SSRF protection bypass in its webhook delivery system. The system validates the registered webhook URL but does not check redirect destinations, and the HTTP client ofetch automatically follows 3xx responses. An attacker can register a webhook pointing to an external server that redirects incoming POSTs to arbitrary internal addresses – loopback, link‑local, or RFC‑1918 ranges – thereby letting an authenticated organisation member force the server to perform internal HTTP requests. This flaw enables internal SSRF, potentially exposing internal services or data. The weakness is identified as CWE‑918.

Any Papra installation running a version earlier than 26.5.0 is vulnerable. The issue applies to the core product provided by papra-hq:papra and affects all organisations that have enabled webhook delivery.

The CVSS score of 3.5 classifies this as low severity, yet the vulnerability permits an authenticated user to access internal addresses on the server’s network. EPSS score is < 1%, so the exact likelihood of exploitation remains uncertain, but the lack of a KEV listing suggests it is not widely exploited. The attack would require only the same permissions needed to register a webhook, which many organisation members possess. Following a redirect chain to a protected address remains possible because the blocklist is not applied to the redirect target. Thus, the risk is the server’s ability to talk to otherwise inaccessible internal services.