Frappe Framework: Path traversal vulnerability (CVE-2026-119145)
Frappe contains a path traversal vulnerability in its file-upload handling that can allow authenticated attackers to achieve remote code execution.
CVE search metadata
CVE search record: CVE-2026-119145. Severity: critical. CVSS: 9.9. KEV: no. Product: Frappe Framework (< 15.121.0, 16.x < 16.34.0). Brief: Frappe Framework: Path traversal vulnerability (CVE-2026-119145). Brief link: https://feed.craftedsignal.io/briefs/2026-10-frappe-traversal/
Triage facts
Revision 1- Applicability
- Frappe Framework (< 15.121.0, 16.x < 16.34.0)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 18:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.