CVE-2026-39352 PoC — Frappe has an Arbitrary File Read via Path Traversal in render_include

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39352.yaml

Associated Vulnerability

Title:Frappe has an Arbitrary File Read via Path Traversal in render_include (CVE-2026-39352)
Description:Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

Description

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

File Snapshot

Log in to view the POC file snapshot cached by Shenlong Bot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →