TI-2026-82663 Aliases CVE-2026-119145 GHSA-rh56-jwhr-hc9r

Path traversal in Frappe file upload allows remote code execution

MEDIUM 44CWE-22Published 2026-10-29 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Frappe from 16.0.0 before 16.34.0 and before 15.121.0 does not validate the destination path of certain file uploads before writing them to disk. An authenticated attacker with low privileges can upload crafted files to locations outside the intended storage directory, which can lead to remote code execution on the server. The flaw is classified as CWE-22.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00761 55th percentileScored 2026-11-07

Fix Fixed frappe (frappe): 16.34.0, 15.121.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
frappe	frappe	16.0.0 to before 16.34.0	16.34.0	Patch available	CNA
frappe	frappe	before 15.121.0	15.121.0	Patch available	CNA

frappe Vendorfrappe Affected 16.0.0 to before 16.34.0 Fixed in 16.34.0 Patch available CNA
frappe Vendorfrappe Affected before 15.121.0 Fixed in 15.121.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:frappe:frappe::::::::	—	—	frappe

cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* Versions — — ·frappe

Remediation

Frappe 16.34.0 fixes the 16.x branch and Frappe 15.121.0 fixes the 15.x branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA frappe (frappe) Fixed in 16.34.0
Fix · CNA frappe (frappe) Fixed in 15.121.0

Timeline

2026-10-29 Threatist record created from CVE-2026-119145
2026-10-29 CISA SSVC decision points changed
2026-10-29 Alias added: GHSA-rh56-jwhr-hc9r

References

Advisory 1

GitHub Security Advisory (GHSA-9pp9-wgp9-3p3j)

TI-2026-28140 ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1CRITICAL 9.8
TI-2025-40873 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
TI-2025-40872 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
TI-2025-40871 A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext… CVSS 3.1CRITICAL 9.8
TI-2025-32462 In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at… CVSS 3.1HIGH 8.2
TI-2025-32461 In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at… CVSS 3.1HIGH 8.2

See all 321 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences