CVE-2026-119145: Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 15.121.0 and 16.x versions before 16.34.0 are affected.
What access does an attacker need to exploit this issue?
An attacker needs authenticated access and the ability to submit a crafted file upload. No user interaction is required.
What is the potential impact of successful exploitation?
A successful attacker can write files outside the intended upload storage directory and achieve remote code execution on the server. The stated impact includes high confidentiality, integrity, and availability effects.