Approved changes feed: RSS · Atom
cpe:2.3:a:papra:papra:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Papra (0dd777a2-6361-5ec8-a265-c22237b9e8ba) |
|---|---|
| Product | Papra (7db8a00e-dcbf-5627-b7af-24755ed4be6e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-35462 |
vulnerable | 2026-06-08 07:59:14.023532 |
Papra Does Not Reject Expired API Keys
MEDIUM (4.3)
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
Published: 2026-04-07T14:30:17.479Z
Updated: 2026-04-07T17:54:02.880Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35461 |
vulnerable | 2026-06-08 07:59:14.023159 |
Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL
MEDIUM (5)
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.
Published: 2026-04-07T14:28:42.063Z
Updated: 2026-04-09T14:41:13.998Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35460 |
vulnerable | 2026-06-08 07:59:14.022620 |
Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name
MEDIUM (4.3)
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from official Papra notifications. This vulnerability is fixed in 26.4.0.
Published: 2026-04-07T14:26:52.943Z
Updated: 2026-04-07T15:59:07.465Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.