---
id: CVE-2026-109603
title: >-
  Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a
  vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling
  server-side request forgery and local file inclusion
summary: >-
  Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a
  vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling
  server-side request forgery and local file inclusion. Authenticated attackers
  can supply cr…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-918
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:24.277'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109603'
references:
  - url: 'https://github.com/frappe/frappe/security/advisories/GHSA-pj59-9hv9-rmrv'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-framework-before-16.17.0-authenticated-ssrf-and-lfi-via-pdfkit
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.616Z'
---

## Overview

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.