CVE-2026-35461

BRIEFING NOTE - CVE-2026-35461 Papra versions prior to 26.4.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the webhook system that allows authenticated users to register arbitrary URLs without validation. The vulnerability enables attackers to force the server to make HTTP POST requests to internal addresses, including localhost and cloud metadata endpoints, when document events occur. The vulnerability carries a CVSS 3.1 score of 5.0 (Medium severity) with a network attack vector and low complexity. While it requires authentication and only results in limited information disclosure, the impact is elevated due to the ability to reach internal systems and cloud provider metadata endpoints that may expose sensitive credentials or configuration data. There is no evidence of active exploitation in the wild. The vulnerability has not been assigned to the Known Exploited Vulnerabilities (KEV) catalog, remains inactive on public hotlists, and shows minimal community attention based on the EPSS score of 0.00028. Organizations should prioritize patching to version 26.4.0 or later as part of routine maintenance rather than as an emergency response.