CVE-2026-119145

    Dashboard / Vulnerabilities / CVE-2026-119145

    CVE-2026-119145

    Published: 29 Oct 2026Last Modified: 31 Oct 2026

    Summary: Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

    Details: Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119145.json, https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j, https://nvd.nist.gov/vuln/detail/CVE-2026-119145, https://www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-upload

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fcbe4d62d66cb4a5d46ff9c5004af1a80a5f6976
    Fixed -c1f1e8ec3708750d7254f7f99d869ffb9886f19f

    Affected versions

    v16.33.1
    v16.33.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119145 | CVE-DB