This vulnerability permits a remote attacker to inject user‑controlled HTML containing elements such as <iframe> into the Print Format feature of ERPNext v16.0.1 and Frappe Framework v16.1.1. When a PDF is generated, the rendering engine fetches referenced resources server‑side, enabling the attacker to force the server to request arbitrary URLs, including internal services and cloud metadata endpoints. The results can be the disclosure of sensitive data such as internal IPs, configuration secrets, or role information, and can compromise overall confidentiality.

ERPNext v16.0.1 and Frappe Framework v16.1.1, when using the Print Format PDF generation feature, are affected. No other versions are known to be impacted.

The CVSS score is not provided; however, the impact potential is high because an attacker can reach services not exposed externally. The EPSS score is unavailable and the vulnerability is not listed in the KEV catalog, suggesting no confirmed active exploitation yet. The attack vector is likely through a crafted print format that the user submits via the web interface, with no special privileges required beyond legitimate user access. If exploited, the server can internally request any network resource, which may lead to information disclosure or further lateral movement.