Live › vulnerability › CVE-2026-119145
Frappe's file-upload handling does not check the destination path before writing to disk, so a crafted upload can land outside the storage directory. An authenticated attacker can use this to achieve remote code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running Frappe or ERPNext sites where logged-in users can upload files. Exposure depends on the version in use and on who holds an account on the site. Sites on a fixed version or with no user upload path are not affected.
No product ranges from the sources yet.
bench version or the frappe entry in the app's lock file; versions before 15.121.0 and 16.x before 16.34.0 are affected.15.121.0 or later.16.34.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-119145")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.