CVE-2026-119145

Summary

A path traversal flaw in Frappe's file-upload handling allows authenticated attackers to write files outside the intended directory by crafting the upload destination path, leading to remote code execution on the server.

Exploitability

Exploitation requires valid authentication and knowledge of the vulnerable upload endpoint; no privilege escalation beyond low-privileged user access is needed.

Blast radius

Successful exploitation grants full server compromise with confidentiality, integrity, and availability impact, potentially affecting all data and services hosted by the application.

Detection

Defenders should monitor for file creation events outside expected upload directories (e.g., in system paths like /etc, /tmp, or application root) and anomalous file extensions or names in logs from the file-upload endpoint.

Prioritized remediation

Upgrade to Frappe version 15.121.0 or later for the 15.x branch, or version 16.34.0 or later for the 16.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.