PT-2026-24785 · Frappe+1 · Frappe

Chakradhar1228 · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-31878

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.100.1 Frappe versions prior to 15.100.0 Frappe versions prior to 16.6.0

Description Frappe is a full-stack web application framework. A malicious user could send a crafted request to an ''endpoint'' which would lead to the server making an HTTP call to a service of the user's choice. The vulnerability involves manipulating a request sent to an endpoint, causing the server to initiate an HTTP call to a service specified by the attacker. The endpoint receives the crafted request.

Recommendations Update Frappe to version 14.100.1 or later. Update Frappe to version 15.100.0 or later. Update Frappe to version 16.6.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-31878

GHSA-MGGG-HMJM-J6C2

Affected Products

Frappe

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31878.json · Exploit
• https://github.com/frappe/frappe/security/advisories/GHSA-mggg-hmjm-j6c2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31878 · Security Note
• https://twitter.com/CVEnew/status/2031992368195592207 · Twitter Post
• https://t.me/cveNotify/155450 · Telegram Post