Frappe Builder EUVD-2026-109781

Requires only a valid authenticated session of any privilege level (CVSS PR:L; the GHSA confirms even a Website User with no Builder access can invoke the endpoint) - no Builder role, admin rights, or user interaction is needed, and default configurations are affected. The exact prerequisite is the ability to call the builder.api.convert_to_webp method with an attacker-controlled image_url. What LIMITS exploitation: (1) an account is needed, so fully anonymous exploitation is not possible; (2) retrieving actual data (versus blind host/port probing) requires the internal response to decode as an image so it is saved to /files/; (3) high-value cloud-metadata theft requires the instance to run in a cloud environment with a reachable link-local metadata endpoint; (4) upgrading to 1.36.1 (which also requires Frappe v16.36.1+) or blocking /api/method/builder.api.convert_to_webp at the reverse proxy - per the vendor, the proxy block also disables in-editor image conversion - closes the issue.

This is a moderate, authentication-gated SSRF (CWE-918) in Frappe Builder, not an emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms remote, low-complexity, authenticated exploitation with no user interaction, and the impact profile is confined to a subsequent-system confidentiality effect (SC:H) with no integrity or availability impact on the vulnerable system (VC:N/VI:N/VA:N), yielding 6.3 (Medium). The GHSA notes the permission gap is severe in practice because ANY logged-in principal - including a Website User with no Builder access - can reach the endpoint, which widens the realistic attacker population beyond Builder operators. No EPSS score and no KEV status were supplied, and the input shows no confirmed proof-of-concept exploit code - the references are the vendor release, the GHSA advisory, and the VulnCheck advisory, not working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-critical priority. Note that the vendor CVSS marks VC:N (no confidentiality impact on the vulnerable system) while the description clearly describes exfiltration of internal/cloud-metadata responses to world-readable /files/ URLs; the real confidentiality exposure to adjacent systems is better captured by SC:H, so treat the headline 6.3 as understating the information-disclosure consequence against cloud-hosted deployments. Overall: a genuine fix-this-cycle issue, elevated where instances run in cloud environments with reachable metadata endpoints.

A low-privilege authenticated user (even a Website User with no Builder access) calls the convert_to_webp API with an image_url pointing at an internal service or a cloud metadata endpoint (e.g. 169.254.169.254), optionally using DNS rebinding or an open redirect to bypass checks. Responses that decode as images are written to a world-readable /files/ URL returned to the caller, exfiltrating internal data; non-image responses still reveal whether an internal host/port answered, enabling blind internal probing. No public exploit code is identified in the provided data.