CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-31017 — A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format fu...

·Source: NIST NVD

Updated:

Executive Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application allows the inclusion of HTML elements such as that reference external resources. The PDF rend

Analysis

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application allows the inclusion of HTML elements such as that reference external resources. The PDF rendering engine automatically fetches these resources on the server side. An attacker can abuse this behavior to force the server to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to sensitive information disclosure. CVSS Score: 9.1. Published: 2026-04-08T17:21:18.737.

Indicators of Compromise (1)

CVE (1)
CVE-2026-31017
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Apr 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-76501 — A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administratio...

A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM and SR

CVE-2026-76501
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-76500 — As part of Cisco's ongoing commitment to proactive security and product quality,...

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76500 are related to

CVE-2026-76500
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-76499 — As part of Cisco's ongoing commitment to proactive security and product quality,...

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to imprope

CVE-2026-76499
NIST NVD