Cpe:2.3:a:frappe:frappe_builder:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afrappefrappe_builder/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 13:41:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFrappe Builder: Server-side request forgery (CVE-2026-115717)https://feed.craftedsignal.io/briefs/2026-10-frappe-ssrf/Mon, 26 Oct 2026 13:41:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-frappe-ssrf/Frappe Builder versions before 1.36.1 contain an SSRF vulnerability in the convert_to_webp endpoint, allowing authenticated users to probe internal infrastructure or exfiltrate sensitive data.Frappe Builder versions prior to 1.36.1 are affected by a server-side request forgery (SSRF) vulnerability. The 'convert_to_webp' API endpoint fails to enforce necessary access controls and does not properly validate user-supplied URLs. An attacker with low-privilege authentication can trigger arbitrary GET requests from the server, which follows redirects without validating destination IPs. This can be exploited to reach internal network resources or cloud metadata services. The application may store the resulting image response in a world-readable file, facilitating data exfiltration.

Impact

Successful exploitation allows authenticated low-privilege users to perform internal network reconnaissance or access sensitive cloud metadata services. Potential data exfiltration may occur if the server-side response is stored in an accessible public file.

Recommendation

  • Upgrade Frappe Builder to version 1.36.1 or later to apply necessary access controls and URL validation to the 'convert_to_webp' endpoint.
  • Review access logs for the 'convert_to_webp' endpoint to identify patterns of abnormal internal network probing.
  • Restrict the server's egress traffic to internal network ranges or cloud metadata endpoints (e.g., 169.254.169.254).
]]>highadvisory