External risk intelligence

Frappe Path Traversal Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-119145

Frappe is a web application framework commonly deployed as an internet-facing service or business web platform. While the vulnerability requires authentication, the platform's role as a web-accessible business application means the attack surface is typically exposed to the internet, making it a likely target for remote interaction in many standard deployment scenarios.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Frappe, a web application framework, allows authenticated attackers to upload malicious files to unauthorized server locations, potentially leading to remote code execution. This issue arises because the system does not properly validate file paths during uploads. Given Frappe's common use in internet-facing business applications, this vulnerability could pose a significant risk if exploited.

Malicious file uploads can compromise server security.
This affects systems that handle sensitive business data.
Confirm Frappe's relevance and exposure to this risk.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access can upload a specially crafted file to the server. This file can be placed outside the intended directory due to insufficient path validation in the file-upload feature, potentially leading to remote code execution.

Authenticated user needed.
Upload crafted file to specific path.
Remote code execution risk.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could execute arbitrary code on the server by uploading specially crafted files that are written to locations outside the intended storage directory, when file-upload handling does not validate the destination path.

Server code execution.
Crafted files bypass destination validation.
Compromise of server integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Frappe framework's path traversal vulnerability impacts authenticated users and could lead to remote code execution, requiring immediate attention from platform and application owners. The first practical step is to identify all instances of the affected technology, assess their exposure and business criticality, locate the accountable owner, and then prioritize remediation based on risk.

Confirm ownership and business criticality of installations.
Verify that only authenticated, trusted users can upload files.
Plan for vendor-provided fixes or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Frappe framework?

Frappe is an open-source, full-stack web application framework primarily used to build business software, including ERPNext. It provides the core structures for data management, user interfaces, and server-side logic. Because it powers complex, data-heavy web applications, it is frequently deployed on servers accessible to business users and administrative staff.

What does path traversal mean for CVE-2026-119145?

This vulnerability is a path traversal flaw (CWE-22). It occurs when the software accepts a filename but fails to check if the path points outside the designated upload folder. Because of this, an attacker can manipulate the file path to write a file into a sensitive system directory, which is the necessary first step to achieving remote code execution on the server.

How does an attacker trigger this vulnerability?

To trigger this, an attacker must have an authenticated account on the Frappe instance. They then use the file-upload feature to send a crafted file with a path manipulation string. If the attacker is not authenticated, they cannot access the upload mechanisms required to initiate this process, as the flaw relies on the application's file-handling logic during an active session.

Why is this CVE considered relevant for my server?

According to Halo Surface Signal, Frappe is often deployed as an internet-facing service to support business operations, which naturally increases its visibility to remote users. Even if the service is internal, the vulnerability is critical because it allows an attacker who has gained a low-level account to potentially take full control of the underlying server.

How should I respond to this Frappe advisory?

Start by identifying all Frappe installations within your environment to determine their business role and internet exposure. Once identified, verify if you are running a version earlier than 15.121.0 or 16.34.0. Prioritize these systems for updates and confirm that access to file-upload features is strictly limited to trusted, authorized users while you plan to apply the vendor-provided security patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.