Executive brief
Frappe Framework and ERPNext, popular open-source business management platforms, contain a security flaw in their PDF generation tool. An attacker can use this to force the server to make unauthorized requests to internal systems or cloud management services. This could lead to the theft of sensitive internal data or provide a foothold for further attacks on the company's private network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1. The root cause is the insufficient sanitization of user-supplied HTML before it is processed by the wkhtmltopdf rendering engine. Although JavaScript is disabled, the engine still processes tags such as <iframe> and <img>, automatically fetching referenced external resources on the server side. A remote attacker can exploit this to force the server to make arbitrary HTTP requests to internal network services or cloud metadata endpoints (e.g., AWS/GCP metadata). This can lead to sensitive information disclosure or internal network enumeration.
Affected products
- Frappe ERPNext 16.0.1
- Frappe Frappe Framework 16.1.1
Timeline
- 2026-01-16: disclosed: Reported to vendor and MITRE
- 2026-04-07: other: CVE assigned
- 2026-04-08: advisory: NVD published date