Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: frappe builder 1.36.1 Clear all filters
TI-2026-80349 CVE-2026-115720

Server-side request forgery in Frappe Builder via HTTP redirects

Priority LOW 24

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) wit…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-10-26 Fixed in 1.36.1 CWE-918
TI-2026-80347 CVE-2026-115717

Server-side request forgery in Frappe Builder image conversion

Priority LOW 28

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and pe…

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00311 Published 2026-10-26 Fixed in 1.36.1 CWE-918