{"id":"CVE-2026-119145","published":"2026-10-29T16:18:08.277","lastModified":"2026-10-29T17:18:08.053","description":"Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j","tags":[]},{"url":"https://www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-upload","tags":[]}],"exploitRefs":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal flaw in Frappe's file-upload handling allows authenticated attackers to write files outside the intended directory by crafting the upload destination path, leading to remote code execution on the server.","exploitability":"Exploitation requires valid authentication and knowledge of the vulnerable upload endpoint; no privilege escalation beyond low-privileged user access is needed.","blast_radius":"Successful exploitation grants full server compromise with confidentiality, integrity, and availability impact, potentially affecting all data and services hosted by the application.","remediation":"Upgrade to Frappe version 15.121.0 or later for the 15.x branch, or version 16.34.0 or later for the 16.x branch.","detection":"Defenders should monitor for file creation events outside expected upload directories (e.g., in system paths like /etc, /tmp, or application root) and anomalous file extensions or names in logs from the file-upload endpoint.","tags":["path-traversal","rce","web-app","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:11:55.598Z"}}