CVE-2026-115717
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL.
Risk Assessment
Data exfiltration from internal networks or cloud metadata and probing of internal hosts is possible. The flaw requires only low privileges of an authenticated user.
Recommendation
Update Frappe Builder to version 1.36.1 or later.
Other vulnerabilities in Frappe Builder
See all- CVE-2026-115720Medium
Frappe Builder before 1.36.1 contains an SSRF vulnerability in builder/api.py where assert_not_private_url() validates only the initial hostname before requests.get(url) follows redirects with no IP pinning. An authenticated attacker can call the convert_to_webp endpoint (lacking a permission decorator) with a URL redirecting to internal targets such as cloud metadata services, enabling SSRF, internal port scanning, or request-hang DoS due to the missing timeout.
- CVE-2026-115718Medium
Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and turning the site into a free LLM proxy.
Original NVD description (English source)
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS