Frappe Framework file upload path traversal lets authenticated users execute code (GHSA-9pp9-wgp9-3p3j)

What happened

Frappe Framework contains a path traversal flaw in file-upload handling. The code does not validate the destination path before writing to disk, so an authenticated user can write a file outside the intended storage directory. That can be turned into remote code execution on the affected host.

The CVSS 3.1 score is 9.9 critical, with a network attack vector, low privilege required and no user interaction. Successful exploitation can compromise confidentiality, integrity and availability, with a changed scope.

There is no statement of active exploitation or public disclosure in the sources used for this page. CISA KEV has no entry for this flaw.

Who is affected

The affected product is Frappe Framework. Versions before 15.121.0 and versions before 16.34.0 are listed. Organisations running Frappe Framework 15.x or 16.x should verify their build. The advisory does not list additional affected components.

What to do now

1. Patch first. Upgrade affected installations to Frappe Framework 16.34.0 or 15.121.0 as appropriate for the release line. The vendor states no workaround is available; upgrading is required.
2. If you cannot patch immediately, restrict access to the application and review accounts that can perform file uploads. This is containment only and does not remediate the flaw.
3. Confirm the installed version after the upgrade and review any hosts that were exposed before patching.

How to detect it

Monitor Frappe Framework hosts for files created or modified outside the configured storage directories, especially unusual executable or script content. Review authenticated file-upload activity from unexpected accounts. The vendor advisory does not provide a specific indicator of compromise.

Beyond the patch

After patching, this flaw is a reminder that a modest authenticated file-upload bug can become full remote code execution. Managed Detection & Response (MDR) helps surface the post-exploitation activity—code execution, privilege escalation or credential abuse—that EDR and SIEM can detect, while Implementation & Assessment Services tests for injection and authentication weaknesses before an attacker does.