Frappe Framework (< 15.121.0, 16.x < 16.34.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/frappe-framework--15.121.0-16.x--16.34.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 18:45:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFrappe Framework: Path traversal vulnerability (CVE-2026-119145)https://feed.craftedsignal.io/briefs/2026-10-frappe-traversal/Thu, 29 Oct 2026 18:45:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-frappe-traversal/Frappe contains a path traversal vulnerability in its file-upload handling that can allow authenticated attackers to achieve remote code execution.<p>Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.</p> criticaladvisory