Is CVE-2026-115720 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115720 being exploited in the wild.

How severe is CVE-2026-115720?

Medium severity, with a CVSS score of 5, published 26 October 2026.

Is there a fix for CVE-2026-115720?

Yes: fixed in 1.36.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115720 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115720?

Check whether you run Frappe Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115720: Frappe Builder server-side request forgery via redirect bypass

CVE-2026-115720 · Severity: medium · CVSS 5 · Published 2026-10-26

Frappe Builder is a visual page builder that allows authenticated users to process remote URLs. A vulnerability in the URL validation logic permits attackers to supply a public URL that redirects to internal systems such as cloud metadata services, enabling unauthorized access to sensitive configuration data or triggering network outages through hung requests.

Technologies: Frappe Builder. Vendors: Frappe.

Quick answers

Is CVE-2026-115720 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115720 being exploited in the wild.
How severe is CVE-2026-115720?: Medium severity, with a CVSS score of 5, published 26 October 2026.
Which products and versions are affected?: Frappe Builder before 1.36.1.
Is there a fix for CVE-2026-115720?: Yes: fixed in 1.36.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115720 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115720?: Check whether you run Frappe Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.36.1

Technical details

The builder/api.py module validates only the initial hostname against a private-IP blocklist before following HTTP redirects, creating a TOCTOU race condition. Attackers can supply a public URL that redirects to internal or link-local addresses (including 100.100.100.200 metadata services), bypass DNS rebinding via second-order host resolution, or trigger denial of service through missing timeouts on the requests.get() call. The convert_to_webp endpoint lacks a permission decorator, exposing it to any authenticated user.

Affected products

Frappe Builder before 1.36.1

Timeline

2026-10-26: disclosed
2026-10-23: patched: Version 1.36.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.