{"id":"CVE-2026-115720","kind":"vulnerability","aliases":["CVE-2026-115720"],"related":[],"title":"Frappe Builder: redirect bypass lets authenticated users reach internal addresses","description":"Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP pinning, allowing an attacker-supplied public URL to HTTP-redirect to internal or link-local addresses the guard never validated. An authenticated attacker can call the convert_to_webp endpoint, which lacks a permission decorator, with a URL that redirects to internal targets such as cloud metadata services to perform SSRF, internal port scanning, or trigger a request-hang denial of service due to the missing timeout.","summary":"Frappe Builder before 1.36.1 checks only the first hostname of a URL passed to its convert_to_webp endpoint, then follows redirects without rechecking. An authenticated attacker can use a public URL that redirects to internal or link-local targets, such as cloud metadata services, to read or probe internal systems.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-metadata","erpnext","frappe","frappe-builder","package","self-hosted"],"not_affected_if":["builder-app-not-installed","fixed-version","no-outbound-to-internal-network"],"how_to_check":"- Check the installed Frappe Builder version in the app's `apps.json` or bench app list; versions below `1.36.1` are affected\n- Confirm whether the `builder` app is installed on the site with `bench --site <site> list-apps`","fix":"- Upgrade Frappe Builder to `1.36.1` or later\n- Until upgraded, restrict outbound access from the server to internal and metadata IP ranges","status":"open","published_at":"2026-10-26T12:17:05+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","triaged_at":"2026-10-26T12:31:44+00:00","updated_at":"2026-10-26T12:31:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T12:31:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Frappe Builder to `1.36.1` or later\n- Until upgraded, restrict outbound access from the server to internal and metadata IP ranges","reach":"internet","title":"Frappe Builder: redirect bypass lets authenticated users reach internal addresses","impact":"medium","summary":"Frappe Builder before 1.36.1 checks only the first hostname of a URL passed to its convert_to_webp endpoint, then follows redirects without rechecking. An authenticated attacker can use a public URL that redirects to internal or link-local targets, such as cloud metadata services, to read or probe internal systems.","category":"package","nicknames":[],"who_cares":["frappe","frappe-builder","erpnext","self-hosted","cloud-metadata"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads cloud metadata credentials and probes internal services","analyst_note":"","how_to_check":"- Check the installed Frappe Builder version in the app's `apps.json` or bench app list; versions below `1.36.1` are affected\n- Confirm whether the `builder` app is installed on the site with `bench --site <site> list-apps`","needs_analyst":false,"not_affected_if":["builder-app-not-installed","fixed-version","no-outbound-to-internal-network"],"who_is_affected":"Self-hosted Frappe or ERPNext sites that have the Builder app installed and running a version before 1.36.1. Sites without the Builder app, or hosts that block outbound requests to private and metadata addresses, face less risk. The endpoint requires a logged-in user, so public-only sites without accounts are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":3440,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115720':13A,16A '-2026':12A,15A '1.36.1':32B,84C 'address':10A,138C 'allow':121C 'assert':97C 'attack':55B,124C,145C 'attacker-suppli':123C 'authent':6A,54B,144C 'builder':2A,24B,30B,82C 'builder/api.py':94C 'bypass':4A 'call':147C 'caller':108C 'check':33B 'cloud':18B,72B,168C 'cloud-metadata':17B 'contain':85C 'convert':44B,149C 'cve':11A,14A 'decor':157C 'default':113C 'denial':183C 'due':186C 'endpoint':47B,152C 'erpnext':20B 'first':36B 'follow':49B,116C 'forgeri':91C 'frapp':1A,21B,23B,29B,81C 'frappe-build':22B 'guard':101C,140C 'hang':182C 'host':28B 'hostnam':37B,106C 'http':130C 'http-redirect':129C 'initi':105C 'intern':9A,64B,79B,133C,164C,174C 'invok':109C 'ip':119C 'lack':154C 'let':5A 'link':67B,136C 'link-loc':66B,135C 'local':68B,137C 'metadata':19B,73B,169C 'miss':189C 'never':141C 'packag':25B 'pass':41B 'perform':172C 'permiss':156C 'pin':120C 'port':175C 'privat':99C 'probe':78B 'public':59B,126C 'reach':8A 'read':76B 'recheck':52B 'redirect':3A,50B,62B,115C,131C,162C 'redirect-follow':114C 'request':90C,181C 'request-hang':180C 'requests.get':110C 'scan':176C 'self':27B 'self-host':26B 'server':88C 'server-sid':87C 'servic':74B,170C,185C 'side':89C 'ssrf':173C 'suppli':125C 'system':80B 'target':69B,165C 'timeout':190C 'trigger':178C 'url':40B,60B,100C,111C,127C,160C 'use':57B 'user':7A 'valid':102C,142C 'vulner':92C 'webp':46B,151C 'without':51B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Frappe or ERPNext sites that have the Builder app installed and running a version before 1.36.1. Sites without the Builder app, or hosts that block outbound requests to private and metadata addresses, face less risk. The endpoint requires a logged-in user, so public-only sites without accounts are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T12:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115720","severity":null,"published_at":"2026-10-26T12:17:05+00:00","modified_at":"2026-10-26T12:17:05+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","fetched_at":"2026-10-26T12:29:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}