CVE-2026-109601 in Frappe
Summary
by MITRE • 10/13/2026
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The Frappe Framework, a popular open-source full-stack web framework used for building business applications such as ERPNext and custom enterprise software, contains a critical security flaw in its email handling subsystem prior versions 15.117.0 and 16.x before 16.30.0. This vulnerability is classified as an arbitrary file read issue that arises from improper validation of user-supplied input within the HTML attributes of outgoing emails. The core technical flaw lies in how the framework processes attribute values when rendering email templates or constructing outbound messages. Specifically, if an attacker can influence the content of an outgoing email, they are able to inject malicious payloads into specific HTML attributes where these values are not sufficiently sanitized against path traversal sequences.
In a typical operation, Frappe allows developers and users to compose emails using templating engines that support dynamic attribute binding. When constructing the final HTML output for delivery, certain attributes may be populated with data derived from user inputs or database records without adequate checks to ensure they do not contain relative paths such as dot-dot-slash sequences. An attacker who has access to any feature of the application that generates outgoing emails can exploit this by setting an attribute value to reference a local file path on the server hosting the Frappe instance. Because the framework fails to restrict or escape these values properly, the underlying email rendering engine may interpret them as literal file paths rather than string literals intended for display.
The operational impact of this vulnerability is severe, particularly in multi-tenant environments where data isolation between different organizations or users is critical. By exploiting this flaw, an authenticated attacker with permissions to send emails can read arbitrary files from the server's filesystem. This could include sensitive configuration files containing database credentials, API keys, secret tokens, source code repositories, or other confidential business logic stored on disk. The ability to exfiltrate such data compromises the confidentiality of the entire system and potentially allows for further attacks if those secrets are used to escalate privileges or access external services.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves accessing files outside the intended scope due to insufficient validation of path inputs. It also maps to MITRE ATT&CK technique T1083: File and Directory Discovery, which describes how adversaries probe for sensitive information on compromised systems. The attack vector is primarily remote but requires initial authentication or access to a feature that triggers email generation, placing it within the context of authenticated exploitation scenarios common in web application attacks.
To mitigate this risk, organizations running affected versions must upgrade immediately to Frappe version 15.117.0 or later for the v15 branch, and version 16.30.0 or later for the v16 branch. These releases include patches that enforce stricter validation on attribute values used in email templates, ensuring that path traversal sequences are neutralized before being processed by the rendering engine. Additionally, administrators should review their application logic to ensure that no custom modules bypass these safeguards when generating outgoing communications. Implementing a content security policy and regularly auditing code for unsafe file operations can further reduce exposure to similar vulnerabilities in future development cycles.