CVE-2026-31017

VULNERABILITY OVERVIEW CVE-2026-31017 is a Server-Side Request Forgery vulnerability affecting ERPNext v16.0.1 and Frappe Framework v16.1.1. The flaw exists in the Print Format functionality where insufficient sanitization of user-supplied HTML allows attackers to inject elements like iframes that trigger server-side resource fetching during PDF generation. This enables attackers to force the application server to make arbitrary HTTP requests to internal services and cloud metadata endpoints. SEVERITY ASSESSMENT The vulnerability carries a CVSS 3.1 score of 9.1 CRITICAL with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, indicating ease of exploitation. The vulnerability has high confidentiality and integrity impact, potentially allowing disclosure of sensitive system information and internal service data. The EPSS score of 0.00039 indicates current exploitation probability is low relative to the broader vulnerability landscape. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability absent from known exploited vulnerabilities (KEV) databases and the Hot List remaining inactive. No public exploit code availability has been reported. Current community attention appears limited given the low EPSS score, though the critical CVSS rating warrants immediate patching for affected organizations using the vulnerable ERPNext and Frappe Framework versions.