CVE-2026-115720 Details

A server-side request forgery (SSRF) vulnerability has been identified in Frappe Builder versions prior to 1.36.1. The issue resides in builder/api.py, where the assert_not_private_url() guard only validates the initial hostname. This oversight allows an attacker-supplied public URL to redirect to internal or link-local addresses that the guard never validated. An authenticated attacker can exploit this by calling the convert_to_webp endpoint, which lacks proper permission controls, with a URL that redirects to internal targets, such as cloud metadata services. This could lead to unauthorized access to sensitive information, internal port scanning, or a denial-of-service condition by causing requests to hang indefinitely due to the absence of a timeout.

Users are advised to upgrade to Frappe Builder version 1.36.1 or later, which addresses this vulnerability by ensuring that all redirected URLs are validated before a connection is made. Version 1.36.x requires Frappe v16.36.1 or later.