CVE-2026-115717— Frappe Builder before 1.36.1 SSRF via convert_to_webp

Quick assessment

Affected

frappe builder

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe Builder 1.36.1 之前的版本在 API 端点中存在服务端请求伪造（SSRF）漏洞。该端点未像其他资产摄入处理器那样实施访问控制，并执行了未经防护的调用；该调用在遵循重定向时未对解析后的 IP 地址进行重新验证。低权限已认证用户可以提供指向内部地址的，或利用 DNS 重绑定和开放重定向，诱导服务器获取内部网络资源或云元数据端点。成功获取的图像响应会被保存至对所有人可读的路径下，从而导致数据泄露或对内部主机进行盲探测。

CVSS 7.7 · High Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1071.001 · Web Protocols T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe Builder before 1.36.1 SSRF via convert_to_webp

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	builder	1.0.0 ~ 1.36.1	-

II. Public POCs for CVE-2026-115717

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115717

请登录查看更多情报信息。

Other References for CVE-2026-115717 (3)

https://github.com/frappe/builder/releases/tag/v1.36.1 patch
https://github.com/frappe/builder/security/advisories/GHSA-5qcg-q3jf-fjcg vendor-advisory
https://www.vulncheck.com/advisories/frappe-builder-before-ssrf-via-convert-to-webp third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-115717

Same Patch Batch · frappe · 2026-10-26 · 4 CVEs total

CVE-2026-116492	6.5 MEDIUM	Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115720	5.0 MEDIUM	Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
CVE-2026-115718	4.3 MEDIUM	Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

IV. Related Vulnerabilities

Same product: builder

Same vendor: frappe

Same weakness: CWE-918