---
id: "CVE-2026-119145"
kind: "vulnerability"
aliases: ["CVE-2026-119145"]
title: "Frappe: file upload path traversal lets authenticated users run code on server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-user-uploads"]
published_at: "2026-10-29T16:18:08+00:00"
first_seen_at: "2026-10-29T16:25:59+00:00"
updated_at: "2026-10-29T16:27:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119145", "first_seen_at": "2026-10-29T16:25:59+00:00"}]
---

# Frappe: file upload path traversal lets authenticated users run code on server

Frappe's file-upload handling does not check the destination path before writing to disk, so a crafted upload can land outside the storage directory. An authenticated attacker can use this to achieve remote code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Frappe version with `bench version` or the `frappe` entry in the app's lock file; versions before `15.121.0` and `16.x` before `16.34.0` are affected.
- Confirm whether the site is reachable by users who hold an account and can upload files.

## Fix

- Frappe 15: move to `15.121.0` or later.
- Frappe 16: move to `16.34.0` or later.

## Timeline

- 2026-10-29T16:25:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119145

## From the sources

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_