This vulnerability involves insufficient sanitization of user-supplied HTML in the PDF generation feature of ERPNext and Frappe Framework. Specifically, the application allows HTML elements such as <iframe> that reference external resources to be included in the HTML content used for PDF rendering. The PDF rendering engine then automatically fetches these external resources server-side, enabling an attacker to coerce the server into making arbitrary HTTP requests to internal or protected endpoints. This can lead to sensitive information disclosure, particularly from cloud metadata services. The vulnerability affects ERPNext v16.0.1 and Frappe Framework v16.1.1. No patch or official remediation level has been published yet.

The impact of this SSRF vulnerability is the potential disclosure of sensitive information from internal services or cloud metadata endpoints by abusing the server's ability to fetch external resources during PDF generation. This could expose confidential data that is not normally accessible externally. There are no reports of active exploitation in the wild. The vulnerability could be leveraged to gather internal network information or credentials if the server environment includes such metadata services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict or sanitize user-supplied HTML content to disallow elements that can trigger server-side requests, such as <iframe>. Consider disabling or limiting PDF generation from untrusted HTML inputs. Monitor vendor channels for updates and apply official patches once available.