6.9

CVE-2026-42219

Frappe: Path Traversal via /backups Route

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerfrappe
≫
Produkt frappe
Version < 15.109.0
Status affected
Version >= 16.0.0-beta.1, < 16.19.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.367
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj
https://github.com/frappe/frappe/pull/38740
https://github.com/frappe/frappe/pull/39402
https://github.com/frappe/frappe/pull/39403
https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc
https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d
https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326
https://github.com/frappe/frappe/releases/tag/v15.109.0
https://github.com/frappe/frappe/releases/tag/v16.19.0