Frappe Framework: Path traversal in file upload leads to remote code execution
Summary
Frappe Framework versions before 15.121.0 and 16.x before 16.34.0 do not validate the destination path during certain file uploads. An authenticated user can write files outside the intended storage directory, which can lead to remote code execution on the server with a CVSS 4.0 score of 9.4 (Critical). The vendor and CNA rate it as critical, while VulDB lists a much lower base score of 6.3. Internet-facing instances or instances with many user accounts, including self-registration, carry the highest risk.
Affected
- Frappe before 15.121.0
- Frappe 16.0.0 up to 16.34.0 (exclusive)
Fixed in
- Frappe 15.121.0
- Frappe 16.34.0
Workaround
No workaround available; upgrading is required (according to the vendor advisory GHSA-9pp9-wgp9-3p3j).
Exploitation
- No known exploitation in the wild (CISA SSVC: Exploitation none, Automatable no).
- No public proof-of-concept exploit found for this CVE.
Our recommendation
- Patch to Frappe 15.121.0 or 16.34.0 (or later) as soon as possible, with priority for internet-facing instances.
- Restrict upload and file-management permissions to the users who really need them.
- Review recently uploaded files and check logs for files written outside the upload directory.
- Check for new or unknown user accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9pp9-wgp9-3p3j github.com
- VulnCheck Advisory: Frappe Path Traversal RCE via File Upload www.vulncheck.com
- VulDB entry 428621 vuldb.com
- Frappe GitHub Security Overview github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:40.
Original description (NVD)
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.