Frappe Framework CVE-2026-109603

Requires an authenticated Frappe account (PR:L) with access to a feature that renders user-controllable content to PDF via the pdfkit library (e.g., print formats, templates, or report-to-PDF flows). The attacker must be able to inject crafted markup/URLs or file references that pdfkit resolves server-side. Exploitation is limited by: mandatory authentication, the need for reachable PDF-generation functionality, and dependence on the vulnerable pdfkit version shipped in Frappe 15.x before 15.107.3 and 16.x before 16.17.0; patched versions remove the condition. No special non-default product configuration is documented as required beyond use of PDF generation.

This is a medium-severity, low-priority issue for most deployments. The vendor CVSS 4.0 base score is 4.8, driven by PR:L (authentication required), limited integrity/availability sub-impacts, and - notably - AV:L (local attack vector) with VC:N (no confidentiality impact). These metrics partially conflict with the vulnerability class: CWE-918 SSRF plus local file inclusion against a web framework would normally imply a network-reachable vector (AV:N) and a real confidentiality impact (embedding local server files into a returned PDF discloses data). The vendor's AV:L and VC:N therefore look conservative or possibly mislabeled - verify the intended vector with Frappe/VulnCheck, as a network-reachable rating would raise the practical score. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at the time of analysis and no evidence of active exploitation. Combined with the authentication requirement, real-world risk is constrained to environments where attackers already hold valid low-privileged Frappe accounts and can reach PDF-generation features; this is a defense-in-depth / patch-in-normal-cycle item rather than an emergency.

An authenticated low-privileged Frappe user crafts content (e.g., a print format or template rendered to PDF) containing references that the vulnerable pdfkit library resolves server-side, causing the server to fetch internal-only URLs (SSRF) or embed local server files into the generated PDF (LFI), which the attacker then downloads. No public proof-of-concept was provided, though the issue derives from the known upstream flaw CVE-2025-26240 in pdfkit. Exploitation requires valid credentials and access to a PDF-rendering feature, limiting opportunistic abuse.