CVE-2026-115720

Name of the Vulnerable Software and Affected Versions Frappe Builder versions prior to 1.36.1

Description An issue exists in builder/api.py where the assert not private url() function only validates the initial hostname. Because requests.get(url) is called with default redirect-following and no IP pinning, a public URL provided by an attacker can redirect to internal or link-local addresses. An authenticated attacker can exploit the convert to webp endpoint, which lacks a permission decorator, to perform Server-Side Request Forgery (SSRF) against internal targets like cloud metadata services, conduct internal port scanning, or cause a request-hang denial of service due to a missing timeout.

Recommendations Update to version 1.36.1. As a temporary mitigation, restrict access to the convert to webp endpoint.