CVE-2026-35461

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35461
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35461.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35461
Aliases
  • GHSA-cjw7-qg95-58mq
Published
2026-04-07T14:28:42.063Z
Modified
2026-08-12T03:51:27.466784008Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL
Details

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35461.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/papra-hq/papra

Affected ranges

Type
GIT
Repo
https://github.com/papra-hq/papra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b29396a1973ef0d02db00b9e685073d7a9dc6e62
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:papra:papra:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.4.0"
        }
    ]
}

Affected versions

@papra/api-sdk@1.*
@papra/api-sdk@1.0.1
@papra/api-sdk@1.0.2
@papra/api-sdk@1.1.0
@papra/api-sdk@1.1.1
@papra/api-sdk@1.1.2
@papra/api-sdk@1.1.3
@papra/app-client@0.*
@papra/app-client@0.0.0
@papra/app-client@0.4.0
@papra/app-client@0.5.0
@papra/app-client@0.5.1
@papra/app-client@0.6.0
@papra/app-client@0.6.1
@papra/app-client@0.6.2
@papra/app-client@0.6.3
@papra/app-client@0.6.4
@papra/app-client@0.7.0
@papra/app-client@0.8.0
@papra/app-client@0.8.1
@papra/app-client@0.8.2
@papra/app-client@0.9.0
@papra/app-client@0.9.1
@papra/app-client@0.9.2
@papra/app-client@0.9.3
@papra/app-client@0.9.4
@papra/app-client@0.9.5
@papra/app-client@0.9.6
@papra/app-server@0.*
@papra/app-server@0.0.0
@papra/app-server@0.4.0
@papra/app-server@0.5.0
@papra/app-server@0.5.1
@papra/app-server@0.6.0
@papra/app-server@0.6.1
@papra/app-server@0.6.2
@papra/app-server@0.6.3
@papra/app-server@0.6.4
@papra/app-server@0.7.0
@papra/app-server@0.8.0
@papra/app-server@0.8.1
@papra/app-server@0.8.2
@papra/app-server@0.9.0
@papra/app-server@0.9.1
@papra/app-server@0.9.2
@papra/app-server@0.9.3
@papra/app-server@0.9.4
@papra/app-server@0.9.5
@papra/app-server@0.9.6
@papra/app@26.*
@papra/app@26.1.0
@papra/app@26.2.0
@papra/app@26.2.1
@papra/app@26.2.2
@papra/app@26.3.0
@papra/cli@0.*
@papra/cli@0.0.1
@papra/cli@0.0.2
@papra/cli@0.1.0
@papra/cli@0.1.2
@papra/cli@0.2.0
@papra/cli@0.2.1
@papra/cli@0.2.2
@papra/docker@25.*
@papra/docker@25.10.0
@papra/docker@25.10.1
@papra/docker@25.10.2
@papra/docker@25.11.0
@papra/docker@25.12.0
@papra/docker@26.*
@papra/docker@26.0.0
@papra/docs@0.*
@papra/docs@0.3.1
@papra/docs@0.4.0
@papra/docs@0.4.1
@papra/docs@0.4.2
@papra/docs@0.5.0
@papra/docs@0.5.1
@papra/docs@0.5.2
@papra/docs@0.5.3
@papra/docs@0.6.0
@papra/docs@0.6.1
@papra/lecture@0.*
@papra/lecture@0.1.0
@papra/lecture@0.2.0
@papra/lecture@0.3.1
@papra/lecture@0.4.0
@papra/lecture@0.5.0
@papra/mobile@1.*
@papra/mobile@1.0.0
@papra/search-parser-demo@0.*
@papra/search-parser-demo@0.0.0
@papra/search-parser@0.*
@papra/search-parser@0.1.1
@papra/webhooks@0.*
@papra/webhooks@0.1.0
@papra/webhooks@0.1.1
@papra/webhooks@0.2.0
@papra/webhooks@0.3.0
@papra/webhooks@0.3.1
@papra/webhooks@0.3.2
@papra/website@0.*
@papra/website@0.0.0
mobile@1.*
mobile@1.0.0
v0.*
v0.0.1
v0.0.1-beta.1
v0.0.1-beta.2
v0.1.0
v0.1.1
v0.1.2
v0.2.0
v0.2.1
v0.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35461.json"