Frappe Framework versions earlier than 15.107.3 and 16.17.0 rely on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation. An authenticated attacker can supply content that is rendered into a PDF, causing the server to fetch internal URLs or embed local files into the generated document. This allows the attacker to access internal network resources, read restricted files on the host, and potentially obtain sensitive data.

The vulnerability affects the Frappe Framework product from the vendor frappe. All 15.x releases prior to 15.107.3 and all 16.x releases prior to 16.17.0 are impacted.

The CVSS score of 4.8 indicates medium‑low severity. Exploitation is not available via EPSS data and the issue is not listed in the CISA KEV catalog. Because the flaw requires an authenticated session, a user with legitimate credentials (or an attacker who has logged in) may craft PDF content to trigger the IPC request. The attack surface is limited to users with write access to PDF generation functions, but the potential impact on confidentiality and integrity of internal resources warrants immediate attention.