CVE-2026-109603

3.3Low

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

3.3Low

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-918

Impact

Authenticated attackers can read local server files and forge server-side requests through crafted PDF generation inputs. They need existing user access to trigger PDF rendering.

Root cause

The framework uses a vulnerable pdfkit dependency (CVE-2025-26240) during PDF generation that improperly handles file inclusions and remote resource fetching.

Affected systems

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade Frappe Framework to version 15.107.3, 16.17.0, or later. If patching immediately is not possible, restrict untrusted user access to PDF export and generation features.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109603