CVE-2026-115717: Frappe Builder before 1.36.1 SSRF via convert_to_webp
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an imageurl pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Builderto a version that resolves this vulnerability.Fixed in 1.36.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated user can exploit the vulnerable convert_to_webp API endpoint. No user interaction is required.
What systems or data could the server be induced to access?
An attacker can make the server request internal network resources or cloud metadata endpoints. DNS rebinding and open redirects can be used to bypass assumptions based only on the initially supplied URL.
Can an attacker retrieve data obtained through the server-side request?
Yes. Successful image responses are saved under a world-readable /files/ URL, which can allow exfiltration of fetched data when the response is handled as an image.
Which versions are affected?
Frappe Builder versions before 1.36.1 are affected. Version 1.36.1 is identified as the release containing the fix.