Live › vulnerability › CVE-2026-115720
Go to dashboardFrappe Builder before 1.36.1 checks only the first hostname of a URL passed to its convert_to_webp endpoint, then follows redirects without rechecking. An authenticated attacker can use a public URL that redirects to internal or link-local targets, such as cloud metadata services, to read or probe internal systems.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 12:29 UTC. All times on this page are UTC.
Self-hosted Frappe or ERPNext sites that have the Builder app installed and running a version before 1.36.1. Sites without the Builder app, or hosts that block outbound requests to private and metadata addresses, face less risk. The endpoint requires a logged-in user, so public-only sites without accounts are less exposed.
No product ranges from the sources yet.
apps.json or bench app list; versions below 1.36.1 are affectedbuilder app is installed on the site with bench --site <site> list-apps1.36.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP pinning, allowing an attacker-supplied public URL to HTTP-redirect to internal or link-local addresses the guard never validated. An authenticated attacker can call the convert_to_webp endpoint, which lacks a permission decorator, with a URL that redirects to internal targets such as cloud metadata services to perform SSRF, internal port scanning, or trigger a request-hang denial of service due to the missing timeout.
This page as .md · .json · in your agent: get_signal("CVE-2026-115720")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.