CVE-2026-39352

Vulnerability

A path traversal vulnerability exists in Frappe framework versions prior to 15.105.0 and 16.15.0, allowing arbitrary file read. The issue is in the handling of file paths, enabling an attacker to read files outside the intended directory. Affected versions: <15.105.0 and <16.15.0 [1][2].

Exploitation

An attacker may exploit this by sending a specially crafted request with path traversal sequences (e.g., ../) to access arbitrary files on the server. No authentication is explicitly mentioned, but given the nature of Frappe, it may require network access to the application [2].

Impact

Successful exploitation allows an attacker to read arbitrary files on the server, potentially exposing sensitive information such as configuration files, source code, or credentials. This could lead to further compromise [2].

Mitigation

The vulnerability is fixed in Frappe versions 15.105.0 and 16.15.0 [1][2]. All users must upgrade to these versions or later. No workarounds are available [2].