Unrated severityNVD Advisory· Published Jul 10, 2026· Updated Jul 13, 2026
Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator
CVE-2026-41482
Description
Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/frappe/frappe/commit/11066591ed7aa91a7b742f3f689277a90e620ce0mitrex_refsource_MISC
- github.com/frappe/frappe/commit/46841f7fde3954e1d3b3a7e248a6d6022343e657mitrex_refsource_MISC
- github.com/frappe/frappe/pull/38643mitrex_refsource_MISC
- github.com/frappe/frappe/pull/39396mitrex_refsource_MISC
- github.com/frappe/frappe/releases/tag/v16.18.3mitrex_refsource_MISC
- github.com/frappe/frappe/security/advisories/GHSA-234v-jfr8-v2f8mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.