CVE-2026-115717

Frappe Builder before 1.36.1 SSRF via convert_to_webp

Published Oct 26, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.

Analysis

Technical impact

Frappe Builder versions before 1.36.1 expose a server‑side request forgery flaw in the convert_to_webp API. The endpoint accepts an image_url parameter, performs an unauthenticated HTTP GET that follows redirects without re‑validating the resulting IP address, and stores the image in a publicly readable /files/ location. This allows a low‑privilege authenticated user to point the request at internal network resources or cloud metadata endpoints, enabling data exfiltration or blind probing of internal hosts.

Affected Systems

The affected product is Frappe Builder, any installation running a version earlier than 1.36.1 is vulnerable. The vulnerability is reported for the 'frappe:builder' suite.

Risk and Exploitability

The CVSS score of 6.3 indicates a medium severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Because the flaw requires only a low‑privilege authenticated user and relies on an external request without proper authorization or IP validation, the likelihood of exploitation is moderate. Attackers could generate internal requests, retrieve files, and store them on the public file server, effectively leaking internal data or enabling further internal reconnaissance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

frappe

builder

unaffected

Version	Status	Constraints
`1.0.0`	affected	< 1.36.1

No data.

Vendor Product Versions

Frappe

Builder

Version	Status	Scheme	Platform
`[1.0.0,1.36.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Frappe Builder version 1.36.1 or later.
Restrict world‑readable permissions on the /files/ directory so that saved images are not publicly accessible.
Implement input validation in convert_to_webp to permit only allowed domains and verify the destination IP after redirects.

Generated by OpenCVE AI on October 26, 2026 at 13:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.311% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/frappe/builder/releases/tag/v1.36.1
https://github.com/frappe/builder/security/advisories/GHSA-5qcg-q3jf-fjcg
https://nvd.nist.gov/vuln/detail/CVE-2026-115717
https://www.cve.org/CVERecord?id=CVE-2026-115717
https://www.vulncheck.com/advisories/frappe-builder-before-ssrf-via-convert-to-webp

History

Nov 2, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 27, 2026 4:30 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-115717 https://www.cve.org/CVERecord?id=CVE-2026-115717
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 26, 2026 12:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.
Title		Frappe Builder before 1.36.1 SSRF via convert_to_webp
First Time appeared		Frappe Frappe builder
Weaknesses		CWE-918
CPEs		cpe:2.3:a:frappe:builder::::::::
Vendors & Products		Frappe Frappe builder
References		https://github.com/frappe/builder/releases/tag/v1.36.1 https://github.com/frappe/builder/security/advisories/GHSA-5qcg-q3jf-fjcg https://www.vulncheck.com/advisories/frappe-builder-before-ssrf-via-convert-to-webp
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}`