This vulnerability involves insufficient sanitization of user-supplied HTML in the PDF generation feature of ERPNext and Frappe Framework. Specifically, the Print Format functionality allows HTML elements such as <iframe> that reference external resources, which the PDF rendering engine fetches server-side. An attacker can leverage this to perform SSRF attacks, causing the server to make arbitrary HTTP requests to internal or protected endpoints, including cloud metadata services. This can lead to sensitive information disclosure. The vulnerability affects ERPNext v16.0.1 and Frappe Framework v16.1.1. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. There is no vendor advisory or patch available at this time.

Successful exploitation allows an attacker to induce the server to make arbitrary HTTP requests to internal or protected network resources, including cloud metadata endpoints. This can result in disclosure of sensitive information and compromise of confidentiality and integrity. The vulnerability does not impact availability. Given the critical CVSS score and the nature of SSRF, the impact is considered severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting or sanitizing HTML input used in PDF generation to disallow elements that can trigger server-side requests, such as <iframe>. Additionally, network-level controls to restrict server outbound HTTP requests to trusted destinations may help mitigate risk.