PT-2026-31332 · Unknown+1 · Frappe Framework+1

Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-31017

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ERPNext version 16.0.1 Frappe Framework version 16.1.1

Description A Server-Side Request Forgery (SSRF) exists in the Print Format functionality. Insufficient sanitization of user-supplied HTML before PDF rendering allows attackers to include HTML elements like <iframe> referencing external resources. The PDF rendering engine fetches these resources on the server side, enabling attackers to force the server to make arbitrary HTTP requests to internal services, potentially disclosing sensitive information, including cloud metadata endpoints.

Recommendations Update ERPNext to a newer version that contains a fix for this vulnerability. Update Frappe Framework to a newer version that contains a fix for this vulnerability.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-31017

Affected Products

Erpnext

Frappe Framework

References · 5

• 🔥 https://github.com/PhDg1410/CVE/tree/main/CVE-2026-31017 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31017 · Security Note
• https://twitter.com/CVEnew/status/2043733108718219456 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041949907234214211 · Twitter Post
• http://frappe.com · Note