CVE-2026-119145

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.121.0 Frappe versions prior to 16.34.0

Description An issue exists in file-upload handling where the destination path is not validated before writing to disk. This allows authenticated attackers to perform path traversal, which is a method of accessing files and directories that are restricted from the user, by uploading crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Recommendations Update to version 15.121.0 Update to version 16.34.0