Detections
Analytics
SCA: security update for @papra/webhooks (GHSA-5g86-85rp-f9hx)
low Tenable Self-Hosted Container Security Plugin ID 443041
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's
webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation
member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and
RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect
destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is
never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled
server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test
against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue
has been patched in version 26.5.0. (CVE-2026-48051)
Solution
Update the @papra/webhooks library and its related packages to version 0.3.3 or later.See Also
Plugin Details
Severity: Low
ID: 443041
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 6/10/2026
Updated: 7/28/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.1
Temporal Score: 1.6
Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2026-48051
CVSS v3
Risk Factor: Low
Base Score: 3.5
Temporal Score: 3.1
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/10/2026
Vulnerability Publication Date: 6/10/2026
Reference Information
CVE: CVE-2026-48051
cwe: CWE-918