Executive brief
Frappe, a web application framework, contains a security vulnerability in its backup download feature. An attacker with high-level administrative privileges could exploit this flaw to access files on the server that they should not be able to see. This could lead to the exposure of sensitive system information or configuration files. The issue has been resolved in the latest software updates.
Technical details
A path traversal vulnerability (CWE-22) exists in the Frappe framework's 'download_backups' functionality. The root cause is a lack of path hardening and sandboxing when handling file requests, allowing an attacker to navigate outside the intended directory. This vulnerability requires high privileges (PR:H) to exploit via a network request. Successful exploitation allows an attacker to read arbitrary files on the server's filesystem that the application process has permissions to access. The fix introduces a 'check_path_safety' utility to ensure requested paths remain within the designated sandbox. Patches are available in versions 15.109.0 and 16.19.0.
Affected products
- Frappe Frappe < 15.109.0, >= 16.0.0-beta.1, < 16.19.0
Timeline
- 2026-04-21: patched: Initial fix merged into develop branch
- 2026-05-22: patched: Backported fixes merged into version 15 and 16 hotfix branches
- 2026-07-10: disclosed: CVE published
References
- https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc
- https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d
- https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326
- https://github.com/frappe/frappe/pull/38740
- https://github.com/frappe/frappe/pull/39402
- https://github.com/frappe/frappe/pull/39403
- https://github.com/frappe/frappe/releases/tag/v15.109.0