CVE-2026-109603: Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Framework 15.xto a version that resolves this vulnerability.Fixed in 15.107.3 - Upgrade
Upgrade
Frappe Framework 16.xto a version that resolves this vulnerability.Fixed in 16.17.0
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe Framework 15.x releases before 15.107.3 and 16.x releases before 16.17.0 are affected when PDF generation uses the vulnerable pdfkit library.
What level of access does an attacker need?
An attacker must be authenticated and able to supply crafted content that is processed by PDF rendering. The attack can then cause the server to request internal resources or include local server files in generated PDFs.
Is this exploitable remotely without a user session?
No. The supplied severity vector identifies local attack access and low privileges required, and the description specifies that attackers must be authenticated.
What should be prioritized for remediation?
Upgrade Frappe Framework 15.x to 15.107.3 or later, or 16.x to 16.17.0 or later. These are the first versions identified as not affected.