CVE-2026-119145— Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

Quick assessment

Affected

frappe frappe

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe 15.121.0 之前的版本以及 16.x 系列中 16.34.0 之前的版本存在路径遍历漏洞，原因是某些文件上传处理逻辑在将文件写入磁盘前未对目标路径进行验证。已认证的攻击者可上传特制文件，将其写入预期存储目录之外的位置，从而在服务器上实现远程代码执行。

CVSS 9.9 · Critical Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	frappe	16.0.0 ~ 16.34.0	-
frappe	frappe	0 ~ 15.121.0	-

II. Public POCs for CVE-2026-119145

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119145

请登录查看更多情报信息。

Other References for CVE-2026-119145 (2)

https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j vendor-advisory
https://www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-upload third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119145

IV. Related Vulnerabilities

Same product: frappe

Same vendor: frappe

Same weakness: CWE-22