Critical severity9.9NVD Advisory· Published Oct 29, 2026· Updated Oct 29, 2026

CVE-2026-119145

Description

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Affected products

Frappe/Frappeinferred2 versions
,<16.34.0+ 1 more
- (no CPE)range: ,<16.34.0
- (no CPE)range: <15.121.0, <16.34.0

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3jnvd
www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-uploadnvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000