PT-2026-30854 · Papra · Papra

Toothless5143 · CVE-2026-35461 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Papra versions prior to 26.4.0

Description The Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints without validation. The server sends HTTP POST requests to these registered URLs, which can include localhost, internal network addresses, and cloud provider metadata endpoints, whenever a document event occurs.

Recommendations Update to version 26.4.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-35461

GHSA-CJW7-QG95-58MQ

Affected Products

Papra

References · 5

• 🔥 https://github.com/papra-hq/papra/security/advisories/GHSA-cjw7-qg95-58mq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35461.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-35461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35461 · Security Note
• https://twitter.com/CVEnew/status/2041603238097547573 · Twitter Post