Server-Side Request Forgery Vulnerability in Frappe Builder by Frappe Technologies

CVE-2026-115717

What is CVE-2026-115717?

Frappe Builder prior to version 1.36.1 is susceptible to a server-side request forgery (SSRF) vulnerability within its convert_to_webp API endpoint. This vulnerability arises from the absence of necessary access control checks, permitting low-privilege authenticated users to exploit an unprotected requests.get call. By providing an image_url pointing to internal addresses or leveraging DNS rebinding and open redirects, attackers can manipulate the server to access internal network resources or cloud metadata services. This leads to potential data exfiltration or unauthorized probing of internal hosts due to responses being accessible at a publicly readable /files/ URL.

References