{"id":"CVE-2026-119145","kind":"vulnerability","aliases":["CVE-2026-119145"],"related":[],"title":"Frappe: file upload path traversal lets authenticated users run code on server","description":"Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.","summary":"Frappe's file-upload handling does not check the destination path before writing to disk, so a crafted upload can land outside the storage directory. An authenticated attacker can use this to achieve remote code execution on the server.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","package","self-hosted"],"not_affected_if":["fixed-version","no-user-uploads"],"how_to_check":"- Check the installed Frappe version with `bench version` or the `frappe` entry in the app's lock file; versions before `15.121.0` and `16.x` before `16.34.0` are affected.\n- Confirm whether the site is reachable by users who hold an account and can upload files.","fix":"- Frappe 15: move to `15.121.0` or later.\n- Frappe 16: move to `16.34.0` or later.","status":"open","published_at":"2026-10-29T16:18:08+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:27:07+00:00","updated_at":"2026-10-29T16:27:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:27:07Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe 15: move to `15.121.0` or later.\n- Frappe 16: move to `16.34.0` or later.","reach":"internet","title":"Frappe: file upload path traversal lets authenticated users run code on server","impact":"high","summary":"Frappe's file-upload handling does not check the destination path before writing to disk, so a crafted upload can land outside the storage directory. An authenticated attacker can use this to achieve remote code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe","erpnext","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs code on the server through a crafted upload","analyst_note":"Confirm which upload endpoints are reachable and whether the fixed-version ranges in the NVD entry match the Frappe release notes.","how_to_check":"- Check the installed Frappe version with `bench version` or the `frappe` entry in the app's lock file; versions before `15.121.0` and `16.x` before `16.34.0` are affected.\n- Confirm whether the site is reachable by users who hold an account and can upload files.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-user-uploads"],"who_is_affected":"Teams running Frappe or ERPNext sites where logged-in users can upload files. Exposure depends on the version in use and on who holds an account on the site. Sites on a fixed version or with no user upload path are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000694,"input_tokens":4134,"output_tokens":562,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119145':15A,18A '-2026':14A,17A '15.121.0':67C '16':69C '16.34.0':72C 'achiev':58B,108C 'attack':53B,95C 'authent':7A,52B,94C 'certain':79C 'check':33B 'code':10A,60B,110C 'contain':73C 'craft':43B,98C 'cve':13A,16A 'destin':35B,88C 'directori':50B,106C 'disk':40B,93C 'erpnext':19B 'execut':61B,111C 'file':2A,28B,81C,99C 'file-upload':27B,80C 'frapp':1A,20B,25B,65C 'handl':30B,83C 'host':24B 'intend':104C 'land':46B 'let':6A 'locat':101C 'outsid':47B,102C 'packag':21B 'path':4A,36B,75C,89C 'remot':59B,109C 'run':9A 'self':23B 'self-host':22B 'server':12A,64B,114C 'storag':49B,105C 'travers':5A,76C 'upload':3A,29B,44B,82C,97C 'use':55B 'user':8A 'valid':86C 'vulner':77C 'write':38B,91C 'x':70C","nicknames":[],"mitigations":[],"who_affected":"Teams running Frappe or ERPNext sites where logged-in users can upload files. Exposure depends on the version in use and on who holds an account on the site. Sites on a fixed version or with no user upload path are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119145","severity":null,"published_at":"2026-10-29T16:18:08+00:00","modified_at":"2026-10-29T16:18:08+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}