Server-Side Request Forgery Vulnerability in Frappe Builder by Frappe
CVE-2026-115720
What is CVE-2026-115720?
Frappe Builder prior to version 1.36.1 is susceptible to a server-side request forgery (SSRF) vulnerability. This flaw resides in builder/api.py where the function assert_not_private_url() insufficiently validates only the initial hostname of incoming requests. Consequently, an authenticated attacker can exploit the convert_to_webp endpoint—lacking proper permission checks—by supplying a URL that can redirect to internal or link-local addresses. This behavior enables an attacker to access sensitive internal services, conduct internal port scans, or cause denial of service by triggering request timeouts due to the ineffective timeout configuration. Immediate update to version 1.36.1 or higher is recommended to mitigate this risk.
Affected Version(s)
builder 1.0.0 < 1.36.1