Frappe path traversal in file upload enables remote code execution for authenticated users (CVE-2026-119145)

What happened

The CVE record describes a path traversal weakness in Frappe's file-upload handling. Frappe does not sufficiently validate the destination path before writing uploaded files to disk. An authenticated attacker with low privileges can upload a crafted file so that it is written outside the intended storage directory. Because the attacker controls the destination path, this can lead to remote code execution on the server.

The CVSS 4.0 score is 9.4, rated critical. The vector is network-based, with low attack complexity, no user interaction, and low privileges required. Impact is rated high for confidentiality, integrity and availability on both the vulnerable system and subsequent systems.

As of the CVE publication date, the CVE record does not indicate active exploitation or public disclosure.

Who is affected

Affected releases are Frappe before 15.121.0 and Frappe 16.0.0 through versions before 16.34.0. These are the framework versions used by ERPNext and related business applications, so the practical question is whether your ERP or business platform is on an affected release. If the instance accepts file uploads from authenticated users, treat this as applying to you.

What to do now

1. Upgrade to a fixed release: frappe 15.121.0 or frappe 16.34.0, depending on your branch. The CVE record lists these as the fixed versions.
2. If you cannot patch immediately, restrict which authenticated accounts can upload files and reduce network access to the application to trusted users only. The flaw requires an authenticated, low-privileged upload path, so tightening these areas reduces exposure until patching.
3. After patching, check upload and adjacent directories for unexpected files outside the intended storage location and review the server for signs of follow-on execution.

How to detect it

Look for new or unexpected files in directories adjacent to the configured Frappe storage location. Also monitor the Frappe server for child processes or command execution spawned by the web application process. The CVE record does not publish specific indicators of compromise.

Beyond the patch

This is an authenticated path traversal that turns a legitimate file-upload function into server-side code execution. Even after patching, the underlying pattern matters: file-upload endpoints and storage paths need testing and hardening, not just updating. Implementation & Assessment Services can test and harden these paths before an attacker discovers them. If code execution does happen, Managed Detection & Response (MDR) is designed to detect the post-exploitation activity and privilege escalation that follows.