CVE-2026-119145
frappe frappe
- frappe frappe
- Critical
- CVSS 9.4
- Fixed version listed
Summary
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk.
From the CVE record.
Read the original description
CVE record
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| frappe frappe | from 16.0.0, before 16.34.0 | 16.34.0 |
| frappe frappe | before 15.121.0 | 15.121.0 |
Advisories and fixes
- Vendor advisory github.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.4 (v4.0, scored by VulnCheck)
- Weakness
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Vendor
- frappe, frappe
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.