Is CVE-2026-115717 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115717 being exploited in the wild.

How severe is CVE-2026-115717?

High severity, with a CVSS score of 7.7, published 26 October 2026.

How is CVE-2026-115717 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115717?

Check whether you run Frappe Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115717: Frappe Builder SSRF in convert_to_webp API

CVE-2026-115717 · Severity: high · CVSS 7.7 · Published 2026-10-26

Frappe Builder is a page design and content management tool used to create web pages and manage digital assets. The convert_to_webp image conversion API endpoint lacks proper access controls and validation, allowing any logged-in user to make the server fetch internal network resources, cloud metadata endpoints, or sensitive files, with results exfiltrated via publicly readable URLs or used to probe internal infrastructure.

Technologies: Frappe Builder. Vendors: Frappe.

Quick answers

Is CVE-2026-115717 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115717 being exploited in the wild.
How severe is CVE-2026-115717?: High severity, with a CVSS score of 7.7, published 26 October 2026.
Which products and versions are affected?: Frappe Builder before 1.36.1.
Is there a fix for CVE-2026-115717?: Yes: fixed in 1.36.1. Until then: Block the /api/method/builder.api.convert_to_webp endpoint at the reverse proxy to prevent exploitation, though this will disable image conversion in the editor. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115717 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115717?: Check whether you run Frappe Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.36.1

Block the /api/method/builder.api.convert_to_webp endpoint at the reverse proxy to prevent exploitation, though this will disable image conversion in the editor.

Technical details

The convert_to_webp API endpoint in Frappe Builder versions before 1.36.1 lacks the has_page_write authorization check and performs unvalidated server-side HTTP requests via requests.get that follow redirects without re-checking IP addresses. Authenticated low-privilege users (including Website Users) can exploit DNS rebinding, open redirects, and path traversal (/../ sequences) to reach internal services, retrieve metadata, or overwrite files outside the intended builder_assets directory. The vulnerability requires authentication but no user interaction, and successful image-like responses are saved to world-readable /files/ URLs enabling data exfiltration.

Affected products

Frappe Builder before 1.36.1

Timeline

2026-10-26: advisory: CVE and GHSA published
2026-10-23: patched: Version 1.36.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.