CVE-2026-109603: Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit

Q: Which deployments are affected?

Frappe Framework 15.x releases before 15.107.3 and 16.x releases before 16.17.0 are affected when PDF generation uses the vulnerable pdfkit library.

Q: What level of access does an attacker need?

An attacker must be authenticated and able to supply crafted content that is processed by PDF rendering. The attack can then cause the server to request internal resources or include local server files in generated PDFs.

Q: Is this exploitable remotely without a user session?

No. The supplied severity vector identifies local attack access and low privileges required, and the description specifies that attackers must be authenticated.

Q: What should be prioritized for remediation?

Upgrade Frappe Framework 15.x to 15.107.3 or later, or 16.x to 16.17.0 or later. These are the first versions identified as not affected.

Published Oct 12, 2026

Updated

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.

Affected Software

1 affected component

Frappe Frappe Framework<15.107.3, <16.17.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe Framework 15.x to a version that resolves this vulnerability.
Fixed in 15.107.3
Upgrade
Upgrade Frappe Framework 16.x to a version that resolves this vulnerability.
Fixed in 16.17.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe Framework 15.x releases before 15.107.3 and 16.x releases before 16.17.0 are affected when PDF generation uses the vulnerable pdfkit library.

What level of access does an attacker need?

An attacker must be authenticated and able to supply crafted content that is processed by PDF rendering. The attack can then cause the server to request internal resources or include local server files in generated PDFs.

Is this exploitable remotely without a user session?

No. The supplied severity vector identifies local attack access and low privileges required, and the description specifies that attackers must be authenticated.

What should be prioritized for remediation?

Upgrade Frappe Framework 15.x to 15.107.3 or later, or 16.x to 16.17.0 or later. These are the first versions identified as not affected.

CVE-2026-109603: Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

Is this exploitable remotely without a user session?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

Is this exploitable remotely without a user session?

What should be prioritized for remediation?