Vulnerability · Published Oct 29, 2026 · Assigned by VulnCheck
CVE-2026-119145Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
Critical 9.9
In plain English
A critical-severity path traversal in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.8%top 44.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-9pp9-wgp9-3p3j) vendor-advisory
- VulnCheck Advisory: Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload third-party-advisory