What is CVE-2026-48051?

CVE-2026-48051 is a low-severity vulnerability in Papra-hq Papra, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.5/10. Published 2026-07-27.

How severe is CVE-2026-48051?

Low severity. CVSS v3 base score is 3.5 out of 10.

SSRF in Papra-hq Papra

CVE-2026-48051

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make H…

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N.

Affected products

Papra-hq Papra — versions < 26.5.0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-48051?: CVE-2026-48051 is a low-severity vulnerability in Papra-hq Papra, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.5/10. Published 2026-07-27.
How severe is CVE-2026-48051?: Low severity. CVSS v3 base score is 3.5 out of 10.