Frappe Framework path traversal in file upload enables remote code execution (GHSA-9pp9-wgp9-3p3j)

What happened

Frappe has published a critical security advisory for Frappe Framework. The flaw is a path traversal (CWE-22) in file-upload handling: the destination path is not validated before data is written to disk. An authenticated user with low privileges can write a file outside the intended storage directory and thereby achieve remote code execution. The attack vector is network-based, requires low privilege, and needs no user interaction, with high impact on confidentiality, integrity and availability. The GitHub advisory rates the issue critical and assigns a CVSS score of 9.9. It does not state that the flaw has been exploited in the wild or publicly disclosed.

Who is affected

Frappe Framework versions before 16.34.0 and before 15.121.0 are affected. Frappe Framework is the application platform that powers ERPNext and many custom business applications, so affected deployments should check both the framework version and the release line. Installations before 16.34.0 should upgrade to 16.34.0; installations before 15.121.0 should upgrade to 15.121.0.

What to do now

1. Identify every Frappe Framework instance and confirm its current version.
2. Upgrade to the fixed release: 16.34.0 for installations before 16.34.0, or 15.121.0 for installations before 15.121.0. The vendor states that no workaround is available and upgrading is required.
3. Validate the running version after the update on all instances, including test and staging environments.
4. Because the flaw is reachable by an authenticated low-privilege user, review accounts with upload permissions and remove or restrict any that are no longer needed.

How to detect it

The GitHub advisory does not provide indicators of compromise. Because the flaw allows an authenticated user to write files outside the intended storage directory, review file storage locations for unexpected files, particularly in directories that are web-accessible or executable. Monitor accounts with upload permissions for unusual upload activity.

Beyond the patch

File-upload validation gaps like this are typically found during a penetration test or hardening review before they become an incident. Our Implementation & Assessment Services exercise file-handling paths in Frappe and custom applications. Because the end state here is code execution, post-exploitation activity is also what our Managed Detection & Response service is built to detect. Patching remains the immediate step; an assessment helps close the same class of flaw elsewhere.