Skip to content
OpenAdvisories

Vendor

papra-hq

5 known vulnerabilities.

papra-hq at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 3 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 2 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202620
Jun 202600
May 202600
Apr 202630
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

papra 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 5.4
    CVE-2026-48052

    Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request

    Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handle…

    papra-hq papra
  • Low 3.5
    CVE-2026-48051

    Papra: SSRF via HTTP redirect bypass in webhook delivery

    Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to inte…

    papra-hq papra @papra/webhooks npm
  • Medium 4.3
    CVE-2026-35462

    Papra Does Not Reject Expired API Keys

    Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely…

    papra-hq papra
  • Medium 5.0
    CVE-2026-35461

    Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL

    Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound H…

    papra-hq papra
  • Medium 4.3
    CVE-2026-35460

    Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name

    Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTM…

    papra-hq papra