What is the CVSS score of CVE-2026-31017?

CVE-2026-31017 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2026-31017?

ERPNext 16.0.1 and Frappe Framework 16.1.1 contain a critical Server-Side Request Forgery vulnerability in PDF generation that allows unauthenticated attackers to force affected servers to retrieve…

How to fix or mitigate CVE-2026-31017?

Within 24 hours: Audit all ERPNext and Frappe Framework instances in production to confirm versions (16.0.1 and 16.1.1); disable PDF print format generation or restrict to authenticated users only. Within 7 days: Contact Frappe/ERPNext vendor for patch availability timeline and interim guidance; implement network segmentation to prevent PDF rendering servers from accessing sensitive internal endpoints and cloud metadata services. Within 30 days: Apply vendor-released patch immediately upon availability to ERPNext and Frappe Framework; conduct forensic review of PDF generation logs to identify any exploitation attempts; validate that print format functionality is re-enabled only after patch verification.

N A CVE-2026-31017

EUVD-2026-20511 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-08 mitre

GHSA-2vgp-8568-m98f

Information Disclosure SSRF N A

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 17:16 euvd

EUVD-2026-20511

Analysis Generated

Apr 08, 2026 - 17:16 vuln.today

CVE Published

Apr 08, 2026 - 00:00 nvd

CRITICAL 9.1

DescriptionNVD

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application allows the inclusion of HTML elements such as <iframe> that reference external resources. The PDF rendering engine automatically fetches these resources on the server side. An attacker can abuse this behavior to force the server to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to sensitive information disclosure.

AnalysisAI

Server-Side Request Forgery in ERPNext 16.0.1 and Frappe Framework 16.1.1 enables unauthenticated attackers to force servers to make arbitrary HTTP requests to internal services through insufficiently sanitized HTML in Print Format PDF generation. Attackers inject HTML elements like <iframe> referencing external resources, which the PDF rendering engine automatically fetches server-side, exposing cloud metadata endpoints and internal network resources. No public exploit identified at time of analysis. CVSS 9.1 severity reflects network-accessible attack vector requiring no authentication or user interaction.

Technical ContextAI

Root cause is inadequate input sanitization (CWE-918) during HTML-to-PDF conversion in Print Format functionality. PDF rendering engine processes user-controlled HTML without filtering resource-fetching elements, allowing attackers to craft malicious payloads triggering server-initiated requests. Vulnerability exploits trust boundary between user input layer and server-side rendering process, bypassing network perimeter controls through legitimate application functionality.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed per GitHub repository at https://github.com/PhDg1410/CVE/tree/main/CVE-2026-31017. Primary mitigation: implement strict HTML sanitization allowlisting for Print Format inputs, removing <iframe>, <embed>, <object>, and other resource-fetching elements before PDF rendering. Deploy egress filtering to block server-initiated requests to RFC1918 private address spaces and cloud metadata endpoints (169.254.169.254, fd00:ec2::254). Monitor https://nvd.nist.gov/vuln/detail/CVE-2026-31017 and http://frappe.com for vendor-released patched versions. If immediate patching unavailable, disable Print Format functionality or restrict access to authenticated trusted users only until sanitization controls are verified.