CVE-2026-31017

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-31017

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31017.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-31017

Published

2026-04-08T00:00:00Z

Modified

2026-07-08T08:00:02.869647906Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application allows the inclusion of HTML elements such as <iframe> that reference external resources. The PDF rendering engine automatically fetches these resources on the server side. An attacker can abuse this behavior to force the server to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to sensitive information disclosure.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31017.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/frappe/erpnext

Affected ranges

Type

GIT

Repo

https://github.com/frappe/erpnext

Events

Introduced

0b1c0c36b521f04f471250ef4db4ab0a86856ea8

Last affected

0b1c0c36b521f04f471250ef4db4ab0a86856ea8

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:frappe:erpnext:16.0.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "16.0.1"
        },
        {
            "last_affected": "16.0.1"
        }
    ]
}

Affected versions

16.*

16.0.1

v16.*

v16.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31017.json"

Git / github.com/frappe/frappe

Affected ranges

Type

GIT

Repo

https://github.com/frappe/frappe

Events

Introduced

598b58b3ff605939fccbce839c393885120c014f

Last affected

598b58b3ff605939fccbce839c393885120c014f

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:frappe:frappe:16.1.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "16.1.1"
        },
        {
            "last_affected": "16.1.1"
        }
    ]
}

Affected versions

16.*

16.1.1

v16.*

v16.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31017.json"