CVE-2026-47194

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

13 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 3 exploit script (poc/poc.py) that performs host header poisoning against Frappe Framework's magic login link feature. It forges the Host header when requesting a login link, captures the resulting poisoned link from a mail sink, extracts the one-time key, and replays it against the real site to obtain a victim session, achieving full account takeover.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-47194, a Host header poisoning vulnerability in Frappe. The Python script (poc/poc.py) performs the disclosed attack steps: requesting a magic login link with a forged Host header, extracting the poisoned link from a mail sink, and replaying the captured key against the real target to achieve account takeover. All network requests target the operator-supplied target_url and mailpit_url. No hidden, unrelated, or deceptive behavior is present. The code is clear, well-commented, and its actions align exactly with the documented vulnerability and attack chain.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwarefrappe
Attack typeshost header poisoningaccount takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact poc/poc.py is a standalone script that actively exploits the vulnerability by forging the Host header, capturing the login key, and replaying it to take over a victim account. It does not merely detect or report the vulnerability; it exercises the full attack chain to achieve account takeover.

poc/poc.py:1-174README.md:45-55

Requirements

  • Target Frappe site must have login_with_email_link enabled (default) and no host_name pinned in site config.README.md:21-30
  • Attacker must know a valid victim email address on the target site.poc/poc.py:38-40
  • Attacker must control a host to receive the poisoned link and have access to a mail sink (e.g., Mailpit) to capture the email.poc/poc.py:38-44

Observed behavior

  • Sends an unauthenticated POST request to /api/method/frappe.www.login.send_login_link with a forged Host header and the victim's email.poc/poc.py:123-128
  • Polls a mail sink API to retrieve the magic login link emailed to the victim and extracts the one-time key.poc/poc.py:88-110
  • Verifies the link host matches the attacker-controlled host, confirming successful poisoning.poc/poc.py:140-148
  • Replays the captured key against the real target site to obtain a session cookie (sid) and confirms the session belongs to the victim via get_logged_user.poc/poc.py:150-170
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
http://127.0.0.1:8080Example target URL in README.md; operator-supplied at runtime.README.md:96
Url
http://127.0.0.1:8025Example mail sink URL in README.md; operator-supplied at runtime.README.md:96
Url
http://evil.attacker.tldExample attacker-controlled host used in the Host header poisoning; operator-supplied at runtime.README.md:96
Review boundaries

What the analysis did not establish

  • Evidence includes only three text files (README.md, poc/poc.py, poc_verification_report.md) out of 13 total files in the artifact; 10 files are unclassified and not analyzed.
  • The exploit script relies on a mail sink (Mailpit) to capture the poisoned email, which is a lab convenience; real-world exploitation would require the attacker to intercept the victim's email or control the attacker host to receive the click.
  • Binary files (e.g., Dockerfiles, shell scripts) were not inspected as they were flagged as metadata-only and not included in the text evidence.
  • The review is limited to the three text files provided; other files in the repository unit were not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

CVE-2026-47194/docker-compose.control.yml

Created Vuln labCVE-2026-47194Compose · mixed

1 Compose manifest · 1 Dockerfile · 4 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for demonstrating CVE-2026-47194, a host-header poisoning vulnerability in Frappe Framework's magic login links. It includes a patched Frappe web application, MariaDB, Redis, and a Mailpit SMTP sink.

CVE-2026-47194/docker-compose.control.yml:1-51CVE-2026-47194/README.md:1-129

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Lab' for CVE-2026-47194, with a patched control stack to verify the fix. The Dockerfile builds a specific patched version of Frappe, and the PoC script targets the vulnerability.

CVE-2026-47194/README.md:1-129CVE-2026-47194/Dockerfile.patched:1-53
Lab shapeCompose · mixed
Services4
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

patched Frappe web application target

Builds Frappe 15.108.0 (first fixed v15 release) from a pinned, checksum-verified source tarball. Serves the application on port 8080, mapped to host port 8081. Configured to use the db, redis, and smtp services.

CVE-2026-47194/docker-compose.control.yml:30-51CVE-2026-47194/Dockerfile.patched:1-53

db

database backend

MariaDB 10.6 database with root password 'root', used by the Frappe web application.

CVE-2026-47194/docker-compose.control.yml:2-14

redis

cache and queue backend

Redis 7 Alpine image used for caching, queuing, and Socket.IO by Frappe.

CVE-2026-47194/docker-compose.control.yml:16-22

smtp

mail sink for capturing exploit evidence

Mailpit instance used to capture emails sent by the Frappe application, including the poisoned magic login link. Its API is exposed on host port 8026.

CVE-2026-47194/docker-compose.control.yml:24-28
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-47194

Supported by supplied evidence

The environment is explicitly built to demonstrate CVE-2026-47194. The Dockerfile builds the patched version (15.108.0) that contains the fix, and the README and PoC script describe the vulnerability and the expected control outcome where the exploit fails.

CVE-2026-47194/README.md:1-129CVE-2026-47194/Dockerfile.patched:1-53CVE-2026-47194/poc/poc.py:1-174
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.CVE-2026-47194/README.md:89-100
  • The host must expose ports 8081 and 8026 for the web application and mail sink, respectively.CVE-2026-47194/docker-compose.control.yml:27-28CVE-2026-47194/docker-compose.control.yml:35-36
  • The seed script (seed.sh) must be run after the stack is up to create the Frappe site and victim user. It uses 'docker exec' to run commands inside the web container.CVE-2026-47194/seed.sh:1-51

Evidence-described exercise path

  1. Build and start the patched control stack: 'docker compose -f docker-compose.control.yml -p cve-2026-47194-control up -d'CVE-2026-47194/README.md:95-96
  2. Run the seed script to create the site and victim user: 'bash seed.sh docker-compose.control.yml cve-2026-47194-control 8081'CVE-2026-47194/README.md:97
  3. Run the PoC exploit against the patched target, expecting it to fail: 'python3 poc/poc.py http://127.0.0.1:8081 victim@lab.local evil.attacker.tld http://127.0.0.1:8026'CVE-2026-47194/README.md:98-99
  4. Verify the PoC output shows '[FAILED]', confirming the patch prevents host-header poisoning.CVE-2026-47194/README.md:99CVE-2026-47194/poc_verification_report.md:1-59
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target components. The PoC script attacks the local web container and reads the local mail sink. The seed script uses 'docker exec' to provision the lab container, which is a documented lab prerequisite. No host compromise, external communication, persistence, or data destruction is evidenced.

CVE-2026-47194/poc/poc.py:1-174CVE-2026-47194/seed.sh:1-51CVE-2026-47194/README.md:1-129
Review boundaries

What the analysis did not establish

  • The packet includes only the patched control Compose file (docker-compose.control.yml). The vulnerable Compose file (docker-compose.yml) and Dockerfile (Dockerfile.vulnerable) are referenced in the README and file inventory but their full text is not provided in evidence_files, limiting a complete comparison of the two stacks.
  • The PoC script's 'attacker_host' parameter (e.g., 'evil.attacker.tld') is a placeholder; the script does not actually set up an external listener or send data off-host. The exercise path relies on the operator to interpret the mail sink as the attacker's captured evidence.
  • The seed script uses 'docker exec' and 'docker cp' to provision the container, which requires Docker socket access. This is a documented lab prerequisite and not an unexpected harmful action.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-47194/docker-compose.yml

Created Vuln labCVE-2026-47194Compose · mixed

1 Compose manifest · 1 Dockerfile · 4 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for reproducing CVE-2026-47194, a host-header poisoning vulnerability in Frappe Framework's magic login links. It consists of four services: a vulnerable Frappe web application, MariaDB, Redis, and a Mailpit SMTP sink to capture poisoned emails.

CVE-2026-47194/docker-compose.yml:1-51CVE-2026-47194/README.md:1-129

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Lab' for CVE-2026-47194, providing a vulnerable target, a patched control, a proof-of-concept exploit, and verification reports. The Docker Compose file and Dockerfile build a specific vulnerable version of Frappe (15.107.5) with the necessary preconditions for the vulnerability.

CVE-2026-47194/README.md:1-129CVE-2026-47194/docker-compose.yml:1-51CVE-2026-47194/Dockerfile.vulnerable:1-54
Lab shapeCompose · mixed
Services4
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable Frappe application target

A Frappe Framework web application built from a pinned vulnerable version (15.107.5). It serves on port 8080 and is configured without a host_name in site config, making it susceptible to Host header poisoning. It depends on db and redis services.

CVE-2026-47194/docker-compose.yml:27-51CVE-2026-47194/Dockerfile.vulnerable:1-54CVE-2026-47194/common_site_config.json:1-13

db

database backend

A MariaDB 10.6 database service used by the Frappe application. It is configured with a root password and a healthcheck.

CVE-2026-47194/docker-compose.yml:2-15

redis

cache and queue backend

A Redis 7 Alpine service used by Frappe for caching and queuing. It has a healthcheck.

CVE-2026-47194/docker-compose.yml:17-24

smtp

mail sink for capturing poisoned emails

A Mailpit service that acts as an SMTP server to capture emails sent by the Frappe application. Its web UI is exposed on port 8025 for inspecting captured emails, which is used by the PoC to extract the poisoned login link.

CVE-2026-47194/docker-compose.yml:26-29CVE-2026-47194/README.md:79-80
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-47194

Supported by supplied evidence

The environment is explicitly built to demonstrate CVE-2026-47194. The README details the vulnerability, the Dockerfile pins the affected version (15.107.5), the PoC script exploits the described Host header poisoning, and the verification report confirms successful reproduction. The fix analysis matches the patch description.

CVE-2026-47194/README.md:1-129CVE-2026-47194/Dockerfile.vulnerable:1-54CVE-2026-47194/poc/poc.py:1-174CVE-2026-47194/poc_verification_report.md:1-59
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.CVE-2026-47194/README.md:82-83
  • The lab must be seeded using seed.sh after the stack is up to create the Frappe site and a victim user (victim@lab.local).CVE-2026-47194/README.md:84-85CVE-2026-47194/seed.sh:1-51
  • The vulnerable Frappe instance must have login_with_email_link enabled (default) and no host_name set in site config (default).CVE-2026-47194/README.md:22-24CVE-2026-47194/poc_verification_report.md:13-15
  • The attacker must control a domain (e.g., evil.attacker.tld) to receive the poisoned link, or use the lab's Mailpit sink as a simulated victim mailbox.CVE-2026-47194/poc/poc.py:40-44

Evidence-described exercise path

  1. Build and start the vulnerable lab stack: docker compose build && docker compose up -dCVE-2026-47194/README.md:83
  2. Seed the lab to create the site and victim user: bash seed.shCVE-2026-47194/README.md:84
  3. Run the PoC exploit: python3 poc/poc.py http://127.0.0.1:8080 victim@lab.local evil.attacker.tld http://127.0.0.1:8025. The script requests a magic login link with a forged Host header, extracts the poisoned link from the Mailpit sink, replays the key against the real site, and verifies account takeover.CVE-2026-47194/README.md:86-88CVE-2026-47194/poc/poc.py:1-174
  4. Optionally, run the patched control to verify the fix: docker compose -f docker-compose.control.yml -p cve-2026-47194-control up -d, seed it, and run the PoC against port 8081. The exploit is expected to fail.CVE-2026-47194/README.md:90-93
  5. Tear down the lab: docker compose down -v (and similarly for the control stack).CVE-2026-47194/README.md:95-96
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target (the web service) and its supporting services. The PoC exploit attacks the local Frappe instance, captures the poisoned email from the local Mailpit sink, and replays the key against the same local instance to demonstrate account takeover. There is no evidence of any action that compromises the Docker host, reaches external systems, persists, steals credentials, downloads unexplained payloads, or behaves like a backdoor. The use of docker exec in seed.sh is for provisioning the lab container and is a documented prerequisite.

CVE-2026-47194/poc/poc.py:1-174CVE-2026-47194/seed.sh:1-51CVE-2026-47194/docker-compose.yml:1-51
Review boundaries

What the analysis did not establish

  • The packet does not include the patched Dockerfile (Dockerfile.patched) or the control Compose file (docker-compose.control.yml) text, so the patched control environment cannot be fully assessed.
  • The packet does not include the intel_brief.md, lab_build_report.md, or vulnerability_analysis.md files, which are referenced in the README but not supplied as evidence.
  • The PoC script uses a hardcoded attacker host 'evil.attacker.tld' as a placeholder; the actual attacker-controlled domain is supplied as a command-line argument, so no external target is hardcoded in the executable logic.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1