CVE-2026-109603
Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
- State
- Published
- Severity
- 4.8 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 12, 2026
Description
Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L | VulnCheck |
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
frappefrappe |
|
References
- GitHub Security Advisory (GHSA-pj59-9hv9-rmrv)vendor-advisory
- VulnCheck Advisory: Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkitthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.