CVE-2026-119145

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

State: Published
Severity: 9.4 Critical
Published: Oct 29, 2026
Updated: Oct 29, 2026
Reserved: Oct 29, 2026

Description

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	VulnCheck
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
frappefrappe	16.0.0 to before 16.34.0Affected 16.34.0Not affected
frappefrappe	before 15.121.0Affected 15.121.0Not affected

References

GitHub Security Advisory (GHSA-9pp9-wgp9-3p3j)vendor-advisory
VulnCheck Advisory: Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Uploadthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.