PT-2026-111020

CVE-2026-109601

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 4.0

8.2

High

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe Framework versions prior to 15.117.0 Frappe Framework versions 16.x prior to 16.30.0

Description An arbitrary file read issue exists in the handling of attributes within outgoing email HTML. Attackers capable of supplying outgoing email content can set an attribute value that references a local file path, allowing them to expose sensitive files from the server.

Recommendations Update to version 15.117.0 or later. Update to version 16.30.0 or later.

Exploitability

Exploit

Fix

Researchers

Ankush

Crypto-Cat

Lukmanazri

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path