CVE-2026-109603— Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Frappe Framework 15.107.3 之前的 15.x 版本和 16.17.0 之前的 16.x 版本中，PDF 生成功能依赖存在漏洞的 pdfkit 库（CVE-2025-26240），这可能导致服务端请求伪造（SSRF）和本地文件包含（LFI）漏洞。攻击者在经过身份验证后，可以提供精心构造的内容给 PDF 渲染引擎，从而使服务器访问内部资源或将本地服务器上的文件嵌入到生成的 PDF 文件中。
Possible ATT&CK Techniques 2 AI
T1041 · Exfiltration Over C2 Channel T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109603
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109603
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109603
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109603 (2)
Same Patch Batch · frappe · 2026-10-12 · 86 CVEs total
| CVE-2026-109667 | 8.8 HIGH | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation |
| CVE-2024-58390 | 8.8 HIGH | Frappe before 15.41.0 Privilege Escalation via Document Action |
| CVE-2026-109652 | 8.8 HIGH | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields |
| CVE-2026-109608 | 8.8 HIGH | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input |
| CVE-2025-71432 | 8.1 HIGH | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover |
| CVE-2026-109633 | 8.1 HIGH | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page |
| CVE-2026-109640 | 8.1 HIGH | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificatio |
| CVE-2026-109604 | 7.3 HIGH | ERPNext before 15.112.0 Stored XSS via Tool View Record Names |
| CVE-2026-109653 | 7.3 HIGH | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover |
| CVE-2026-109671 | 7.3 HIGH | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages |
| CVE-2026-109673 | 7.3 HIGH | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names |
| CVE-2026-109612 | 7.3 HIGH | Frappe ERPNext before 15.120.0 Stored XSS via Report View |
| CVE-2026-109613 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati |
| CVE-2026-109616 | 7.1 HIGH | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification |
| CVE-2026-109617 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints |
| CVE-2026-109614 | 6.5 MEDIUM | Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109627 | 6.5 MEDIUM | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109615 | 6.5 MEDIUM | Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints |
| CVE-2026-109656 | 6.5 MEDIUM | Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access |
| CVE-2026-109610 | 6.5 MEDIUM | Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modifica |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109602
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filter -
CVE-2026-109600
Frappe before 16.31.0 Improper Access Control in Document Fo -
CVE-2026-109601
Frappe Framework before v16.30.0 Arbitrary File Read via Out
Same vendor: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes
Same weakness: CWE-918
-
CVE-2026-111323
RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/v -
CVE-2026-111321
TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in A -
CVE-2026-111320
ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/mo -
CVE-2026-111313
JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch -
CVE-2026-111171
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP
V. Comments for CVE-2026-109603
No comments yet