Frappe file upload path traversal enables remote code execution for authenticated users (CVE-2026-119145)

What happened

Frappe's file-upload handling does not validate the destination path before writing files to disk. Because of this, an authenticated attacker with low privileges can exploit the flaw over the network without user interaction. A crafted upload can be written outside the intended storage directory, leading to remote code execution on the server. The flaw is classed as CWE-22 path traversal and has a CVSS 4.0 score of 9.4, critical, with high impact to confidentiality, integrity and availability on both the vulnerable system and subsequent systems.

The CVE record does not show active exploitation or public disclosure.

Who is affected

Frappe installations are affected in two release lines. The 15.x line is vulnerable before 15.121.0. The 16.x line is vulnerable from 16.0.0 through versions before 16.34.0. Any deployment where authenticated users can upload files is exposed; the attack is network-based and requires only low privilege, so internet-facing and multi-user business application instances are the more likely targets.

What to do now

1. Upgrade to a patched Frappe release. The fixed versions are 15.121.0 for the 15.x line and 16.34.0 for the 16.x line.
2. If immediate patching is not possible, restrict file-upload permissions to trusted users and review which roles can upload files. This reduces the attack surface but does not remove the vulnerability.
3. Check storage and web-accessible directories for recently created files outside the normal upload paths, and prioritise remediation on any instance where unexpected files are found.

How to detect it

Look for files appearing outside the normal upload directory, particularly in directories that can serve or execute code. Review upload logs for filenames with path traversal sequences and for low-privilege accounts writing to unexpected locations. Comparing current storage against a known-good baseline can help identify writes that occurred before patching.

Beyond the patch

Beyond patching, this is an authenticated upload path leading to code execution, so hardening should be verified before an attacker finds it. Implementation & Assessment Services can test and harden file-upload handling across your Frappe or ERPNext deployment. Once code executes, the subsequent activity is what Managed Detection & Response (MDR) is designed to catch, because EDR and SIEM see the trail left by code execution, privilege escalation or credential abuse.