---
id: CVE-2026-119145
title: >-
  Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File
  Upload
summary: >-
  Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal
  vulnerability because certain file-upload handling does not validate the
  destination path before writing to disk. Authenticated attackers can upload
  crafted files t…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: frappe
product: frappe
affected:
  - frappe >= 16.0.0 < 16.34.0
  - frappe < 15.121.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-29T16:29:06.486688Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T17:14:19.218Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119145'
references:
  - url: 'https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j'
    label: GitHub Security Advisory (GHSA-9pp9-wgp9-3p3j)
  - url: >-
      https://www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-upload
    label: >-
      VulnCheck Advisory: Frappe before 15.121.0 and 16.x before 16.34.0 Path
      Traversal RCE via File Upload
tags:
  - cve.org
epss: 0.00761
epssPercentile: 0.55339
ingestedAt: '2026-11-01T21:01:32.750Z'
---

## Overview

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

## Affected

- `frappe >= 16.0.0 < 16.34.0`
- `frappe < 15.121.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.