Executive Summary

CVE-2026-35461 is a Server-Side Request Forgery (SSRF) vulnerability in the Papra document management platform's webhook system prior to version 26.4.0.

Authenticated users can register arbitrary webhook URLs without any validation of the destination address. When document events occur, the Papra server sends HTTP POST requests to these registered URLs.

Because there is no filtering or IP resolution checks, the server can be tricked into making requests to internal network addresses, localhost, or cloud provider metadata endpoints (such as AWS metadata service).

This allows attackers to potentially access sensitive internal resources or cloud credentials by abusing the webhook feature.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts:

• Cloud Credential Theft: On cloud-hosted Papra instances, attackers can exploit SSRF to access cloud metadata endpoints and steal live IAM credentials.
• Internal Metadata Leakage: Sensitive document metadata (such as documentId, organizationId, and timestamps) is sent to attacker-controlled endpoints.
• Internal Network Reconnaissance: Attackers can scan internal IP ranges and services by registering webhooks targeting various internal addresses, using response statuses stored in the database to map the network.
• Response Exfiltration: HTTP responses from internal endpoints are stored in the database, potentially leaking sensitive data, although these responses are not accessible via the UI or API.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring outbound HTTP POST requests made by the Papra server to arbitrary URLs, especially those targeting localhost, internal network IP ranges (RFC-1918), and cloud provider metadata endpoints such as AWS's 169.254.169.254.

Since the server stores all webhook delivery responses in the database table `webhook_deliveries` (including `response_payload` and `response_status`), reviewing this table for requests to suspicious internal or cloud metadata IPs can help identify exploitation attempts.

Network detection can include capturing outbound HTTP POST traffic from the Papra server and filtering for requests to internal IP ranges or metadata service IPs.

• Use network monitoring tools like tcpdump or Wireshark to capture outbound HTTP POST requests from the Papra server.
• Example tcpdump command to capture HTTP POST requests to internal IP ranges: `tcpdump -i <interface> tcp and dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16 and 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'`
• Check the Papra database table `webhook_deliveries` for entries with response statuses and payloads indicating requests to internal or cloud metadata endpoints.
• Look for unusual webhook URLs registered by authenticated users that point to localhost, internal IPs, or cloud metadata endpoints.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Papra to version 26.4.0 or later, where this vulnerability is fixed.

Until the upgrade is applied, restrict or monitor webhook URL registrations to prevent authenticated users from registering URLs pointing to localhost, internal network IP ranges, or cloud metadata endpoints.

Implement network-level controls such as firewall rules to block outbound HTTP requests from the Papra server to internal IP ranges and cloud metadata IP addresses.

• Upgrade Papra to version 26.4.0 or later.
• Restrict webhook URL registrations to trusted external domains.
• Apply firewall rules to block outbound HTTP POST requests from the Papra server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), link-local (169.254.0.0/16), and cloud metadata IPs (e.g., 169.254.169.254).
• Monitor the `webhook_deliveries` database table for suspicious webhook delivery responses.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to register arbitrary webhook URLs that the server will call with document metadata, potentially exposing sensitive internal information and cloud credentials.

This exposure of sensitive document metadata and cloud credentials could lead to unauthorized data access or leakage, which may violate data protection regulations such as GDPR or HIPAA that require strict controls over personal and sensitive data.

Additionally, the storage of webhook delivery responses containing internal data in the database, even if not accessible via UI or API, represents a risk of sensitive data exposure.

Therefore, this vulnerability could negatively impact compliance with standards that mandate confidentiality and integrity of sensitive information.

Useful 0 Not Useful 0