CVE-2026-115717

Publié : 26 octobre 2026

Modifié : 26 octobre 2026

Score CVSS

7.7

HIGH

Description détaillée

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Références et Patchs

https://github.com/frappe/builder/releases/tag/v1.36.1 https://github.com/frappe/builder/security/advisories/GHSA-5qcg-q3jf-fjcg https://www.vulncheck.com/advisories/frappe-builder-before-ssrf-via-convert-to-webp

Dernières Vulnérabilités

CVE-2026-93846

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734

VOIR DÉTAILS

CVE-2026-85297

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

VOIR DÉTAILS

CVE-2026-65226

Rejected reason: This CVE ID has been rejected by runZero as unused.

VOIR DÉTAILS