Frappe Builder up to 1.36.0 URL Validation builder/api.py assert_not_private_url server-side request forgery

Summaryinfo

A vulnerability classified as critical has been found in Frappe Builder up to 1.36.0. This issue affects the function assert_not_private_url of the file builder/api.py of the component URL Validation. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2026-115720. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Frappe Builder up to 1.36.0 and classified as critical. Affected by this vulnerability is the function assert_not_private_url of the file builder/api.py of the component URL Validation. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP pinning, allowing an attacker-supplied public URL to HTTP-redirect to internal or link-local addresses the guard never validated. An authenticated attacker can call the convert_to_webp endpoint, which lacks a permission decorator, with a URL that redirects to internal targets such as cloud metadata services to perform SSRF, internal port scanning, or trigger a request-hang denial of service due to the missing timeout.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-115720 since 10/23/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.36.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-109785). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Frappe

Name

• Builder

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36.0

Website

• Product: https://github.com/frappe/builder/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion