An SSRF vulnerability in the Print Format feature of ERPNext v16.0.1 and Frappe v16.1.1 permits an attacker to supply user‑controlled HTML containing <iframe> elements that the server fetches during PDF generation, directing the server to perform arbitrary HTTP requests to internal or cloud metadata endpoints, thereby disclosing sensitive data.

ERPNext v16.0.1 and the underlying Frappe Framework v16.1.1 are affected. The flaw exists in the Print Format functionality that renders user‑supplied HTML into PDF. No other product versions are listed as affected in the available data.

The flaw carries a CVSS score of 9.1, indicating a high impact and exploitability. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation so far, and the vulnerability is not currently cataloged by CISA's KEV list. The attack vector is inferred to be the ability to supply arbitrary HTML to the Print Format interface—any user with privileges to create or modify print formats could inject malicious content and trigger the SSRF. Because the server component performs the external fetch, the impact is on the system's network, potentially exposing internal services. The high CVSS score and the data‑disclosure nature underscore the need for mitigation even if exploitation is currently rare.