{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/frappe-builder--1.36.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frappe:frappe_builder:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-115717"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Frappe Builder (\u003c 1.36.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Frappe"],"content_html":"\u003cp\u003eFrappe Builder versions prior to 1.36.1 are affected by a server-side request forgery (SSRF) vulnerability. The 'convert_to_webp' API endpoint fails to enforce necessary access controls and does not properly validate user-supplied URLs. An attacker with low-privilege authentication can trigger arbitrary GET requests from the server, which follows redirects without validating destination IPs. This can be exploited to reach internal network resources or cloud metadata services. The application may store the resulting image response in a world-readable file, facilitating data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated low-privilege users to perform internal network reconnaissance or access sensitive cloud metadata services. Potential data exfiltration may occur if the server-side response is stored in an accessible public file.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Frappe Builder to version 1.36.1 or later to apply necessary access controls and URL validation to the 'convert_to_webp' endpoint.\u003c/li\u003e\n\u003cli\u003eReview access logs for the 'convert_to_webp' endpoint to identify patterns of abnormal internal network probing.\u003c/li\u003e\n\u003cli\u003eRestrict the server's egress traffic to internal network ranges or cloud metadata endpoints (e.g., 169.254.169.254).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T13:41:51Z","date_published":"2026-10-26T13:41:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-frappe-ssrf/","summary":"Frappe Builder versions before 1.36.1 contain an SSRF vulnerability in the convert_to_webp endpoint, allowing authenticated users to probe internal infrastructure or exfiltrate sensitive data.","title":"Frappe Builder: Server-side request forgery (CVE-2026-115717)","url":"https://feed.craftedsignal.io/briefs/2026-10-frappe-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Frappe Builder (\u003c 1.36.1)","version":"https://jsonfeed.org/version/1.1"}