CVE-2026-115717 Details

A server-side request forgery (SSRF) vulnerability has been identified in Frappe Builder versions prior to 1.36.1. The issue resides in the convert_to_webp API endpoint, which lacks proper access control and performs unprotected requests that can follow redirects without re-validating resolved IP addresses. This vulnerability allows low-privilege authenticated users to manipulate the image_url parameter to target internal addresses or exploit open redirects and DNS rebinding, causing the server to fetch internal network resources or cloud metadata. Successful exploitation can lead to data exfiltration or blind probing of internal hosts, as retrieved images are saved to a publicly accessible /files/ URL.

Users can update to Frappe Builder version 1.36.1 or later, which addresses the vulnerability by implementing the necessary access controls, restricting file writes to the appropriate directories, and ensuring that only public URLs are fetched. For those using Frappe version 16.36.1 or later, the update to Builder 1.36.1 will also be applicable.