Read the docs
TI-2026-80349 Aliases CVE-2026-115720

Server-side request forgery in Frappe Builder via HTTP redirects

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Frappe Builder from 1.0.0 before 1.36.1 has a server-side request forgery flaw (CWE-918). The URL guard checks only the initial hostname, so HTTP redirects can reach internal or link-local addresses that are never validated. An authenticated attacker with low privileges can send such requests through the convert_to_webp endpoint, which lacks a permission check, to reach internal services or cloud metadata. Requests have no timeout, so they can hang.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP pinning, allowing an attacker-supplied public URL to HTTP-redirect to internal or link-local addresses the guard never validated. An authenticated attacker can call the convert_to_webp endpoint, which lacks a permission decorator, with a URL that redirects to internal targets such as cloud metadata services to perform SSRF, internal port scanning, or trigger a request-hang denial of service due to the missing timeout.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Fix Fixed builder (frappe): 1.36.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
frappebuilder1.0.0 to before 1.36.11.36.1Patch availableCNA
  • builder Vendorfrappe Affected 1.0.0 to before 1.36.1 Fixed in 1.36.1 Patch available CNA

Remediation

Upgrade Frappe Builder to version 1.36.1, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA builder (frappe) Fixed in 1.36.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    frappe builder 1.36.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-80347 Server-side request forgery in Frappe Builder image conversionPriority LOW 28
    Show all 2 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-115720
  2. 2026-10-26 CISA SSVC decision points changed

References

Patch 1

Advisory 1

  • TI-2026-28140 ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1CRITICAL 9.8
  • TI-2025-40873 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40872 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40871 A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext… CVSS 3.1CRITICAL 9.8
  • TI-2025-32462 In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at… CVSS 3.1HIGH 8.2
  • TI-2025-32461 In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at… CVSS 3.1HIGH 8.2
See all 321 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences