CVE-2026-42219: Frappe path traversal in download_backups

CVE-2026-42219 · Severity: info · CVSS 6.9 · Published 2026-07-10

Frappe, a web application framework, contains a security vulnerability in its backup download feature. An attacker with high-level administrative privileges could exploit this flaw to access files on the server that they should not be able to see. This could lead to the exposure of sensitive system information or configuration files. The issue has been resolved in the latest software updates.

Technologies: Frappe Technologies Frappe Framework. Vendors: Frappe Technologies.

Quick answers

Is CVE-2026-42219 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42219 being exploited in the wild.
How severe is CVE-2026-42219?
Informational severity, with a CVSS score of 6.9, published 10 July 2026.
Which products and versions are affected?
Frappe Technologies Frappe Framework < 15.109.0, >= 16.0.0-beta.1, < 16.19.0.
Is there a fix for CVE-2026-42219?
A patch was published on 2026-04-21: Initial fix merged into develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42219 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42219?
Check whether you run Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the Frappe framework's 'download_backups' functionality. The root cause is a lack of path hardening and sandboxing when handling file requests, allowing an attacker to navigate outside the intended directory. This vulnerability requires high privileges (PR:H) to exploit via a network request. Successful exploitation allows an attacker to read arbitrary files on the server's filesystem that the application process has permissions to access. The fix introduces a 'check_path_safety' utility to ensure requested paths remain within the designated sandbox. Patches are available in versions 15.109.0 and 16.19.0.

Affected products

  • Frappe Frappe < 15.109.0, >= 16.0.0-beta.1, < 16.19.0

Timeline

  • 2026-04-21: patched: Initial fix merged into develop branch
  • 2026-05-22: patched: Backported fixes merged into version 15 and 16 hotfix branches
  • 2026-07-10: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.