CVE-2026-115720 | Frappe Builder up to 1.36.0 URL Validation builder/api.py assert_not_private_url server-side request forgery

October 26, 2026 Yanac

A vulnerability described as critical has been identified in Frappe Builder up to 1.36.0. This vulnerability affects the function assert_not_private_url of the file builder/api.py of the component URL Validation. The manipulation results in server-side request forgery.

This vulnerability is identified as CVE-2026-115720. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More