{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/frappe-framework--15.111.0-16.x--16.21.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frappe:framework:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-119145"},{"cvss":8.8,"id":"CVE-2026-119144"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Frappe Framework (\u003c 15.121.0, 16.x \u003c 16.34.0)","Frappe Framework (\u003c 15.111.0, 16.x \u003c 16.21.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Frappe"],"content_html":"\u003cp\u003eFrappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.\u003c/p\u003e\n","date_modified":"2026-10-29T20:37:25Z","date_published":"2026-10-29T18:45:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-frappe-traversal/","summary":"Frappe contains a path traversal vulnerability in its file-upload handling that can allow authenticated attackers to achieve remote code execution.","title":"Frappe Framework: Path traversal vulnerability (CVE-2026-119145)","url":"https://feed.craftedsignal.io/briefs/2026-10-frappe-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Frappe Framework (\u003c 15.111.0, 16.x \u003c 16.21.0)","version":"https://jsonfeed.org/version/1.1"}