Frappe Builder EUVD-2026-109785

Requires an authenticated session: the convert_to_webp endpoint has no permission decorator and is reachable by ANY authenticated Builder user before 1.36.1, while the import_remote_assets and import_remote_fonts fetches additionally require Builder Page write permission. The attacker must supply a public URL that either HTTP-redirects to an internal/link-local target or whose DNS answer changes between the guard's check and the actual connection (DNS rebinding); default redirect-following and the absence of IP pinning on requests.get make this work against default configurations. Limiting factors: authentication is mandatory (no unauthenticated path), impact is confined to SSRF-style internal reachability, metadata disclosure (including 100.64.0.0/10 addresses), internal port scanning, and a request-hang DoS from the missing timeout - there is no direct code execution or write to the vulnerable system. Only complete fix per vendor is upgrading to 1.36.1 (which requires Frappe v16.36.1+); no workarounds exist.

This is a moderate, credibly-real but non-emergency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score are consistent with the description: network-reachable, low-complexity, but requiring authentication (PR:L) and yielding only subsequent-system confidentiality impact (SC:L) with no direct impact to the vulnerable system (VC:N/VI:N/VA:N). The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the limited impact. No EPSS score was provided, the CVE is not listed in CISA KEV, and no confirmed working exploit code is present in the input - the references are the vendor release, the GHSA advisory, the VulnCheck advisory, and fix PR #989, i.e. disclosure and remediation artifacts rather than weaponized exploits. The real differentiator from a 'high-CVSS-but-low-real-risk' paper finding is the specific, confirmed mechanism: a time-of-check/time-of-use guard that validates the hostname once and then follows redirects and re-resolves DNS without re-checking, reaching cloud metadata endpoints (including the 100.64.0.0/10 / 100.100.100.200 case). That makes exploitation mechanically straightforward for any authenticated user, but the authentication requirement and confidentiality-only impact keep it a prioritized-patch item rather than a drop-everything event. Note the GHSA also assigns CWE-367 (TOCTOU) alongside CWE-918, reflecting the DNS-rebinding variant in addition to the redirect bypass.

An authenticated Frappe Builder user (no elevated role needed) calls the convert_to_webp endpoint, which lacks a permission decorator, supplying a public URL under their control. That URL HTTP-redirects - or re-resolves via DNS rebinding - to an internal or link-local address such as a cloud metadata service, which the one-time hostname guard never re-validates, letting the server fetch and return internal data or hang on a missing timeout. No public working exploit is identified at time of analysis, though the vendor GHSA and fix PR describe the mechanism in detail.