Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
Date: 2026-06
Affected: npm/@papra/webhooks
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-48051
CWE: CWE-918
CVSS: 3.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N)

### Summary Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (`ofetch`) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. ### Details **The vulnerable call** The webhook HTTP client in `packages/webhooks/src/webhooks.services.ts` (lines 16–19) calls `ofetch.raw()` without specifying a `redirect` option: ```typescript const response = await ofetch.raw<unknown>(url, { ...options, ignoreResponseError: true, // no `redirect` option — defaults to 'follow' per Fetch API spec }); ``` `ofetch` is a thin wrapper around the WHATWG Fetch API. The Fetch specification defines three redirect modes — `follow`, `error`, and `manual` — and sets `follow` as the default. In `follow` mode, the HTTP implementation resolves the redirect chain internally and returns only the final response; application code receives the terminal response with no indication that any redirects occurred. `ofetch` 1.


Mitigations:

Architectural layers (MAESTRO):