CVE-2026-109603

Name of the Vulnerable Software and Affected Versions Frappe Framework versions 15.x through 15.107.2 Frappe Framework versions 16.x through 16.16.9

Description The software uses a vulnerable pdfkit library for PDF generation, which allows authenticated attackers to perform server-side request forgery (SSRF) and local file inclusion (LFI). By providing specially crafted content to the PDF rendering process, an attacker can force the server to retrieve internal resources or embed local server files within the resulting PDF documents.

Recommendations Update Frappe Framework 15.x to version 15.107.3 or later. Update Frappe Framework 16.x to version 16.17.0 or later.