PT-2026-24785 · Frappe+1 · Frappe

Chakradhar1228 · Publicado 2026-03-11 · Atualizado 2026-03-13 · CVE-2026-31878

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.100.1 Frappe versions prior to 15.100.0 Frappe versions prior to 16.6.0

Description Frappe is a full-stack web application framework. A malicious user could send a crafted request to an ''endpoint'' which would lead to the server making an HTTP call to a service of the user's choice. The vulnerability involves manipulating a request sent to an endpoint, causing the server to initiate an HTTP call to a service specified by the attacker. The endpoint receives the crafted request.

Recommendations Update Frappe to version 14.100.1 or later. Update Frappe to version 15.100.0 or later. Update Frappe to version 16.6.0 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-31878

GHSA-MGGG-HMJM-J6C2

Produtos afetados

Frappe

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31878.json · Exploit
• https://github.com/frappe/frappe/security/advisories/GHSA-mggg-hmjm-j6c2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31878 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031992368195592207 · Publicação no Twitter
• https://t.me/cveNotify/155450 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-31878 · Nota de Segurança