Critical RCE Vulnerability in Frappe File Upload Handling

www.vulncheck.com

Critical RCE Vulnerability in Frappe File Upload Handling

First seen 29 Oct 2026, 23:43 UTC • •69.2

Article Content

1 / 7

Browse articles

ThreatCluster •October 30, 2026 at 01:14 UTC

•CVE-2026-119145 allows RCE via file upload in Frappe.
•Affected versions include Frappe 15.x before 15.121.0 and 16.x before 16.34.0.
•Immediate patching or restricting upload permissions is recommended.

A critical vulnerability (CVE-2026-119145) has been identified in Frappe's file upload handling, allowing authenticated attackers with low privileges to exploit a path traversal flaw that can lead to remote code execution. The vulnerability affects Frappe installations in the 15.x line prior to version 15.121.0 and the 16.x line from version 16.0.0 to before 16.34.0. The flaw is categorized as CWE-22 and has a CVSS score of 9.4, indicating a severe impact on confidentiality, integrity, and availability. There are currently no reports of active exploitation or public disclosure of the vulnerability. Organizations are advised to upgrade to the patched versions or restrict file-upload permissions to trusted users as an interim measure. Monitoring for unexpected file creations in storage directories is also recommended. The vulnerability was disclosed on October 29, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-29

CVE-2026-119145 published

Frappe disclosed a critical path traversal vulnerability allowing RCE via file uploads.

Spirityenterprise

More articles in this cluster (6)

Threat Graph

6 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Vulnerability (2)

CVE-2026-119145
Path Traversal

Weakness (1)

CWE-22 - Path Traversal

Affected Platform (2)

ERPNext
Frappe

Relationships

CVE-2026-119145 targets ERPNext
CVE-2026-119145 targets Frappe
Path Traversal targets ERPNext
Path Traversal targets Frappe
Zero-day Exploit targets ERPNext
Zero-day Exploit targets Frappe
CVE-2026-119145 related to CWE-22 - Path Traversal

Following this threat?

Track CVE-2026-119145 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which versions of Frappe are affected?

Frappe versions 15.x before 15.121.0 and 16.x from 16.0.0 to before 16.34.0 are affected.

Is there any active exploitation of this vulnerability?

Currently, there are no reports of active exploitation or public disclosure of CVE-2026-119145.

What should organizations do to mitigate this risk?

Organizations should upgrade to the patched versions or restrict file-upload permissions to trusted users.

Continue Reading

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…

Critical Path Traversal Vulnerability in FearlessCMS Disclosed A critical vulnerability, CVE-2026-63190, has been identified in FearlessCMS, a flat-file content management system, allowing unauthenticated attackers to execute privileged PHP scripts in the `/admin/` directory. This flaw arises from improper authentication and path validation, enabling attackers to perform path…