CVE-2026-42219 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
GitHub_M	CNA	6.9 MEDIUM	NETWORK	LOW	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
frappe	frappe	𝑥 < 15.109.0	CNA

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc

https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d

https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326

https://github.com/frappe/frappe/pull/38740

https://github.com/frappe/frappe/pull/39402

https://github.com/frappe/frappe/pull/39403

https://github.com/frappe/frappe/releases/tag/v15.109.0

https://github.com/frappe/frappe/releases/tag/v16.19.0

https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj