Frappe Builder: Server-side request forgery (CVE-2026-115717)

Frappe Builder versions prior to 1.36.1 are affected by a server-side request forgery (SSRF) vulnerability. The 'convert_to_webp' API endpoint fails to enforce necessary access controls and does not properly validate user-supplied URLs. An attacker with low-privilege authentication can trigger arbitrary GET requests from the server, which follows redirects without validating destination IPs. This can be exploited to reach internal network resources or cloud metadata services. The application may store the resulting image response in a world-readable file, facilitating data exfiltration.

Impact

Successful exploitation allows authenticated low-privilege users to perform internal network reconnaissance or access sensitive cloud metadata services. Potential data exfiltration may occur if the server-side response is stored in an accessible public file.

Recommendation

• Upgrade Frappe Builder to version 1.36.1 or later to apply necessary access controls and URL validation to the 'convert_to_webp' endpoint.
• Review access logs for the 'convert_to_webp' endpoint to identify patterns of abnormal internal network probing.
• Restrict the server's egress traffic to internal network ranges or cloud metadata endpoints (e.g., 169.254.169.254).