PT-2026-132376

CVE-2026-119145

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 3.1
9.9
Critical
MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2026-119145
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com