CVE-2026-31017 is a critical server side request forgery (CVSS 9.1) in the Print Format feature of ERPNext v16.0.1 and Frappe Framework v16.1.1. User supplied HTML rendered to PDF can make the server fetch internal URLs. The record names no fixed version, so check the vendor advisory.
What's affected
The record names ERPNext v16.0.1 and Frappe Framework v16.1.1. It does not say whether other versions are affected and does not name a fixed version. Check the Frappe and ERPNext release notes and security advisories before you decide.
How to check if you're exposed
Find your versions from the command line on a bench install:
bench version
If you run version 16 of either product, look at who can create or edit Print Formats. The risk depends on whether untrusted users can supply the HTML that gets rendered.
What to do now
- Check the Frappe and ERPNext security pages for a fixed release and upgrade when one is available.
- Limit permission to create or edit Print Formats to trusted roles.
- On cloud servers, require the metadata service token mode that blocks simple requests, and restrict outbound traffic from the app server to what it needs.
- Block access from the application host to internal services that it does not need to call.
Why it matters
The weakness class is CWE-918, server side request forgery. The PDF engine fetches resources that the HTML refers to, such as those in an iframe, and it does so from the server. An attacker can point those references at internal addresses the attacker cannot reach directly.
The record highlights cloud metadata endpoints, which can return credentials to the machine that asks. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Why is a PDF feature a network risk?
Rendering engines load whatever the markup points to. If the markup is not trusted, the server becomes a proxy for the attacker.
Sources
Last reviewed: 19 October 2026.
