CVE-2026-119145 in Frappe
Summary
by MITRE • 10/29/2026
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Frappe framework, prior to versions 15.121.0 and 16.34.0, contains a critical path traversal vulnerability within its file-upload handling mechanism. This flaw stems from an insufficient validation of user-supplied input when determining the destination path for uploaded files. Specifically, the application fails to sanitize or canonicalize filenames provided by users before constructing the final filesystem path where the data will be written. This lack of rigorous input validation allows attackers to manipulate the intended directory structure using standard traversal sequences such as dot-dot-slash characters. By exploiting this weakness, an authenticated user can direct file writes to arbitrary locations on the server's disk that are outside the designated storage directories for application assets or uploads.
The operational impact of this vulnerability is severe, primarily because it facilitates remote code execution under specific conditions. If a web server interprets files in these external locations as executable scripts, such as Python, PHP, or shell scripts depending on the deployment configuration, an attacker can upload malicious payloads to those paths and subsequently trigger their execution via HTTP requests. This effectively grants the attacker control over the underlying operating system with the privileges of the user account running the Frappe application process. The requirement for authentication means that while this is not a fully unauthenticated exploit, it poses a significant risk in environments where legitimate users may have compromised credentials or if internal threats are considered part of the threat model.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws allowing access to files outside the restricted directory. It also relates closely to CWE-434: Unrestricted Upload of File with Dangerous Type if the uploaded content includes executable code that is subsequently executed by the server. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1505.003: Web Shell, as it enables the placement and execution of malicious scripts on a web server for persistent access and lateral movement within the network infrastructure.
Mitigation strategies should focus primarily on upgrading the Frappe framework to version 16.34.0 or later, where these path validation issues have been addressed by developers through stricter input sanitization and canonicalization checks before file system operations. For organizations unable to immediately patch their systems due to compatibility constraints, temporary mitigations include implementing strict allow-lists for allowed characters in filenames at the application level rather than relying on blocklists which can be bypassed with encoding tricks or alternative traversal sequences. Additionally, deploying a Web Application Firewall capable of detecting path traversal patterns in file upload parameters may provide an additional layer of defense. It is also crucial to ensure that web server configurations restrict execution permissions for directories outside standard static asset paths and enforce least-privilege principles so that the application process does not have write access to sensitive system areas or executable script locations unless absolutely necessary.