CVE-2026-55852 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
GitHub_M	CNA	8.6 HIGH	NETWORK	LOW	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
frappe	frappe	𝑥 < 15.112.0	CNA

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfd

https://github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223

https://github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7

https://github.com/frappe/frappe/pull/38716

https://github.com/frappe/frappe/pull/40044

https://github.com/frappe/frappe/pull/40045

https://github.com/frappe/frappe/releases/tag/v15.112.0

https://github.com/frappe/frappe/releases/tag/v16.23.0

https://github.com/frappe/frappe/security/advisories/GHSA-58w2-4cjg-hvp6