{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "cve-2026-119145",
    "url": "https://cveboard.org/i/cve-2026-119145",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-119145",
    "json": "https://cveboard.org/i/cve-2026-119145.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "frappe frappe",
    "summary": "Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk.",
    "titlePt": "frappe frappe",
    "summaryPt": "Frappe antes de 15.121.0 e 16.x antes de 16.34.0 contém uma vulnerabilidade de path traversal porque o manuseio de upload de certos arquivos não valida o caminho de destino antes de escrever no disco.",
    "affected": [
      {
        "vendor": "frappe",
        "product": "frappe",
        "defaultStatus": "unaffected",
        "versions": [
          {
            "version": "16.0.0",
            "status": "affected",
            "lessThan": "16.34.0",
            "lessThanOrEqual": null
          },
          {
            "version": "16.34.0",
            "status": "unaffected",
            "lessThan": null,
            "lessThanOrEqual": null
          }
        ],
        "omitted": 0,
        "fixed": [
          "16.34.0"
        ]
      },
      {
        "vendor": "frappe",
        "product": "frappe",
        "defaultStatus": "unaffected",
        "versions": [
          {
            "version": "0",
            "status": "affected",
            "lessThan": "15.121.0",
            "lessThanOrEqual": null
          },
          {
            "version": "15.121.0",
            "status": "unaffected",
            "lessThan": null,
            "lessThanOrEqual": null
          }
        ],
        "omitted": 0,
        "fixed": [
          "15.121.0"
        ]
      }
    ],
    "omitted": 0,
    "references": [
      {
        "url": "https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j",
        "tag": "vendor-advisory"
      }
    ],
    "cwes": [
      {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      }
    ],
    "ssvc": null,
    "fix": "listed",
    "tags": [
      "frappe"
    ],
    "description": "Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.",
    "descriptionFrom": "cve",
    "descriptionAt": null,
    "summaryFrom": "cve",
    "cves": [
      "CVE-2026-119145"
    ],
    "ghsa": null,
    "cvss": {
      "score": 9.4,
      "version": "4.0",
      "by": "VulnCheck"
    },
    "epss": null,
    "packages": [],
    "vendor": "frappe",
    "product": "frappe",
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "cve.now",
        "url": "https://cve.now/CVE-2026-119145"
      }
    ],
    "cveVersion": 1,
    "cvePending": false,
    "publishedAt": "2026-10-29T15:58:23.465Z",
    "updatedAt": "2026-10-29T15:58:23.465Z"
  },
  "live": true,
  "events": [
    {
      "id": "cvenow:CVE-2026-119145:cvenow_discovered:first",
      "incidentId": "cve-2026-119145",
      "type": "cvenow_discovered",
      "at": "2026-10-29T15:58:23.465Z",
      "detail": {}
    }
  ]
}