CVE-2026-115720

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP pinning, allowing an attacker-supplied public URL to HTTP-redirect to internal or link-local addresses the guard never validated. An authenticated attacker can call the convert_to_webp endpoint, which lacks a permission decorator, with a URL that redirects to internal targets such as cloud metadata services to perform SSRF, internal port scanning, or trigger a request-hang denial of service due to the missing timeout.

• https://github.com/frappe/builder/releases/tag/v1.36.1
• https://github.com/frappe/builder/security/advisories/GHSA-hvrf-fhv3-3v7p

• https://github.com/frappe/builder/releases/tag/v1.36.1
• https://github.com/frappe/builder/security/advisories/GHSA-hvrf-fhv3-3v7p
• https://www.vulncheck.com/advisories/frappe-builder-before-ssrf-guard-bypass-via-http-redirect

• HIGHCVE-2020-37278PoC
• HIGHCVE-2023-54402PoC
• MEDIUMCVE-2024-34319
• UNSCOREDCVE-2026-0311
• LOWCVE-2026-100104
• MEDIUMCVE-2026-100251
• MEDIUMCVE-2026-100257
• MEDIUMCVE-2026-100279

Related by shared AI tags and CWE weakness class. Browse the full archive.