CVE-2026-115717 frappe CVE debrief

Who should care

Defenders responsible for Frappe Builder deployments, particularly those with internal network resources or cloud metadata endpoints that could be accessed through this vulnerability, should assess their exposure and prioritize applying the available patch.

Why it matters

Defenders should care about CVE-2026-115717 because it allows low-privilege authenticated users to potentially exfiltrate data or probe internal hosts through a server-side request forgery vulnerability in Frappe Builder versions before 1.36.1. The vulnerability's impact is medium, with a CVSS score of 6.3, and its exploitation requires user interaction. Defenders responsible for Frappe Builder deployments should assess their exposure, prioritize applying the available patch (version 1.36.1), and monitor for suspicious activity related to the convert_to_webp API endpoint.

• Potential data exfiltration through successful image responses saved to world-readable /files/ URLs
• Blind probing of internal hosts through DNS rebinding and open redirects
• Exposure of internal network resources to low-privilege authenticated users
• Verification of patch application to prevent exploitation

Technical summary

The convert_to_webp API endpoint in Frappe Builder versions before 1.36.1 lacks the has_page_write access control and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. This allows low-privilege authenticated users to supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints.

Defensive priority

Defenders should prioritize verifying exposure of internal network resources and cloud metadata endpoints, assessing the impact of potential data exfiltration or blind probing of internal hosts, and applying the available patch (version 1.36.1) to mitigate the vulnerability.

Recommended defensive actions

• Verify exposure of internal network resources and cloud metadata endpoints
• Assess the impact of potential data exfiltration or blind probing of internal hosts
• Apply the available patch (version 1.36.1) to mitigate the vulnerability
• Monitor for suspicious activity related to the convert_to_webp API endpoint
• Perform vulnerability scanning to identify exposed Frappe Builder deployments
• Implement additional logging and monitoring for the convert_to_webp API endpoint
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the available patch.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.