CVE-2026-119145

EUVD-2026-113212
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
frappefrappe
16.0.0 ≤
𝑥
< 16.34.0
CNA
frappefrappe
𝑥
< 15.121.0
CNA
Common Weakness Enumeration
References
https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j
https://www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-upload