CVE-2026-115720
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Frappe Builder before 1.36.1 contains an SSRF vulnerability in builder/api.py where assert_not_private_url() validates only the initial hostname before requests.get(url) follows redirects with no IP pinning. An authenticated attacker can call the convert_to_webp endpoint (lacking a permission decorator) with a URL redirecting to internal targets such as cloud metadata services, enabling SSRF, internal port scanning, or request-hang DoS due to the missing timeout.
Risk Assessment
SSRF can allow access to internal services and cloud metadata and enable internal network scanning. The missing timeout also permits denial-of-service attacks.
Recommendation
Update Frappe Builder to version 1.36.1 or later.
Other vulnerabilities in Frappe Builder
See all- CVE-2026-115718Medium
Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and turning the site into a free LLM proxy.
- CVE-2026-115717High
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL.
Original NVD description (English source)
Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP pinning, allowing an attacker-supplied public URL to HTTP-redirect to internal or link-local addresses the guard never validated. An authenticated attacker can call the convert_to_webp endpoint, which lacks a permission decorator, with a URL that redirects to internal targets such as cloud metadata services to perform SSRF, internal port scanning, or trigger a request-hang denial of service due to the missing timeout.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS