Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-119145EUVD-2026-113212

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 16.34.0, 15.121.0
Public exploit
None on Exploit-DB, Metasploit or GitHub
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  4. Record last updated

Affected versions

  • frappe frappe

    From 16.0.0 · fixed in 16.34.0

  • frappe frappe

    fixed in 15.121.0

References 2

GitHub · frappe/frappe

vulncheck.com