CVE-2026-115717

A flaw was found in Frappe Builder. An authenticated user with low privileges can trigger a Server-Side Request Forgery SSRF vulnerability by submitting a malicious URL to the converttowebp API endpoint, which lacks proper access controls and redirect validation. This allows the attacker to coerc...

CVE-2026-115720

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115717

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

EUVD-2026-109785

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115720

Frappe Builder versions before 1.36.1 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability in builder/api.py. The root cause is that the assert_not_private_url() guard only validates the initial hostname, while subsequent requests.get(url) calls follow redirects by default without...

CVE-2026-115720 Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115717 Frappe Builder before 1.36.1 SSRF via convert_to_webp

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

CVE-2026-115717

Frappe Builder versions before 1.36.1 are vulnerable to a Server-Side Request Forgery (SSRF) in the convert_to_webp API endpoint. The flaw exists because the endpoint lacks the has_page_write access control used by other asset-ingest handlers and performs an unprotected requests.get call that fol...

EUVD-2026-109781

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...