papra-hq vulnerabilities and threats

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.

Papra versions prior to 26.4.0 contain a vulnerability where API keys with expiration dates are not validated against the current time during authentication. This means expired API keys remain valid indefinitely, allowing continued access to protected endpoints. The issue is identified as insufficient session expiration (CWE-613) and is fixed in version 26.4.0. The vulnerability has a medium severity with a CVSS score of 4.3.

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.

Papra versions prior to 26.4.0 contain a vulnerability where user display names are directly interpolated into transactional email HTML templates without proper escaping or sanitization. This allows an attacker to inject HTML tags into verification and password reset emails sent from the legitimate domain, enabling phishing attacks that appear as official Papra notifications. The vulnerability is classified as a basic cross-site scripting (XSS) issue and has a medium severity rating with a CVSS score of 4.3. It is fixed in version 26.4.0.