This vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-controlled HTML content is rendered into PDFs without adequate sanitization. The PDF rendering engine processes HTML elements such as <iframe> that reference external URLs, causing the server to perform HTTP requests to those URLs. An attacker can leverage this to induce the server to send requests to internal or cloud metadata endpoints, leading to possible sensitive data disclosure. The CVSS score is 9.1 (critical), indicating high impact on confidentiality and integrity without requiring privileges or user interaction. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to perform SSRF attacks via the PDF generation process, enabling the server to make arbitrary HTTP requests to internal network resources or cloud metadata services. This can lead to sensitive information disclosure and compromise of internal infrastructure confidentiality. The vulnerability does not affect availability but has high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Print Format feature to trusted users only and consider disabling PDF generation from user-supplied HTML. Monitor vendor channels for updates and apply patches promptly once released.