CVE-2026-115717
Received Received - Intake

Server-Side Request Forgery in Frappe Builder

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115717
EUVD
EUVD-2026-109781

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe builder 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Frappe Builder versions before 1.36.1. It exists in the convert_to_webp API endpoint due to missing access controls. The endpoint performs unprotected requests.get calls that follow redirects without re-validating IP addresses. A low-privilege authenticated user can exploit this by providing an image URL pointing to internal addresses or using DNS rebinding and open redirects. This allows the server to fetch internal network resources or cloud metadata endpoints. Successful responses are saved to a world-readable /files/ URL, enabling data exfiltration or probing of internal hosts.

Detection Guidance

Check Frappe Builder versions before 1.36.1 by running: grep -r 'version.*1\.[0-9][0-9]\.[0-9]' /path/to/frappe/builder. Monitor network traffic for unexpected outbound requests to internal IPs or cloud metadata endpoints from the server hosting Frappe Builder.

Impact Analysis

An attacker with low privileges could access internal network resources or cloud metadata endpoints through your server. They could exfiltrate data by saving sensitive information to publicly accessible files. The vulnerability also allows probing of internal hosts and ports, potentially revealing network structure. Attackers could overwrite existing public files or write files outside intended directories using path traversal. Even non-image responses might leak information about internal systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protecting sensitive health information. It enables data leakage through public file URLs, potentially exposing personal or protected data. Organizations may face compliance violations, regulatory fines, and reputational damage if this vulnerability is exploited to access or leak regulated data.

Mitigation Strategies

Upgrade Frappe Builder to version 1.36.1 or later immediately. Block the convert_to_webp endpoint at the reverse proxy as a temporary workaround. Restrict access to the endpoint to users with Builder Page write permissions only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115717. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart