CVE-2026-48051 is an SSRF vulnerability in papra-hq's papra product affecting versions before 26.5.0. The webhook delivery system validates the initial webhook URL against an SSRF blocklist but does not validate redirect destinations. The HTTP client (ofetch) automatically follows 3xx redirects, allowing an attacker to register a webhook URL pointing to an attacker-controlled server that redirects requests to internal IP ranges such as loopback, link-local, and RFC-1918 addresses. This enables an authenticated organization member to cause the server to make unauthorized HTTP requests to internal network resources. The vulnerability was confirmed by live testing and fixed with a single-line change in the HTTP client in version 26.5.0.

An authenticated organization member can exploit this SSRF vulnerability to make the papra server send HTTP requests to internal network addresses that are normally inaccessible externally. This could potentially expose internal services or data reachable via these internal addresses. The CVSS score is 3.5 (low), reflecting limited impact with low privileges required and no direct confidentiality or integrity loss reported beyond limited information exposure.

This vulnerability is patched in papra version 26.5.0. Users should upgrade to version 26.5.0 or later to remediate the SSRF protection bypass. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the vendor stating the fix is included in version 26.5.0.