Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M
CVE-2026-41482Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator
High 7.1
In plain English
A high-severity path traversal in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/frappe/frappe/security/advisories/GHSA-234v-jfr8-v2f8 x_refsource_CONFIRM
- https://github.com/frappe/frappe/pull/38643 x_refsource_MISC
- https://github.com/frappe/frappe/pull/39396 x_refsource_MISC
- https://github.com/frappe/frappe/commit/11066591ed7aa91a7b742f3f689277a90e620ce0 x_refsource_MISC
- https://github.com/frappe/frappe/commit/46841f7fde3954e1d3b3a7e248a6d6022343e657 x_refsource_MISC
- https://github.com/frappe/frappe/releases/tag/v16.18.3 x_refsource_MISC