---
id: CVE-2026-115720
title: Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
summary: >-
  Frappe Builder before 1.36.1 contains a server-side request forgery
  vulnerability in builder/api.py where the assert_not_private_url() guard
  validates only the initial hostname before callers invoke requests.get(url)
  with default redirec…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: frappe
product: builder
affected:
  - builder >= 1.0.0 < 1.36.1
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T12:02:25.906Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115720'
references:
  - url: 'https://github.com/frappe/builder/releases/tag/v1.36.1'
    label: Vendor Patch
  - url: 'https://github.com/frappe/builder/security/advisories/GHSA-hvrf-fhv3-3v7p'
    label: Vendor Advisory
  - url: >-
      https://www.vulncheck.com/advisories/frappe-builder-before-ssrf-guard-bypass-via-http-redirect
    label: >-
      VulnCheck Advisory: Frappe Builder before 1.36.1 SSRF Guard Bypass via
      HTTP Redirect
tags:
  - cve.org
ingestedAt: '2026-10-26T12:26:18.476Z'
---

## Overview

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP pinning, allowing an attacker-supplied public URL to HTTP-redirect to internal or link-local addresses the guard never validated. An authenticated attacker can call the convert_to_webp endpoint, which lacks a permission decorator, with a URL that redirects to internal targets such as cloud metadata services to perform SSRF, internal port scanning, or trigger a request-hang denial of service due to the missing timeout.

## Affected

- `builder >= 1.0.0 < 1.36.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.