Junglewise Threat Intelligence

CVE-2026-42219: Frappe path traversal in download_backups

CVE-2026-42219 · Severity: info · CVSS 6.9 · Published 2026-07-10

Technologies: Frappe, Frappe Technologies Frappe Framework. Vendors: Frappe, Frappe Technologies.

Executive brief

Frappe, a web application framework, contains a security vulnerability in its backup download feature. An attacker with high-level administrative privileges could exploit this flaw to access files on the server that they should not be able to see. This could lead to the exposure of sensitive system information or configuration files. The issue has been resolved in the latest software updates.

Technical details

A path traversal vulnerability (CWE-22) exists in the Frappe framework's 'download_backups' functionality. The root cause is a lack of path hardening and sandboxing when handling file requests, allowing an attacker to navigate outside the intended directory. This vulnerability requires high privileges (PR:H) to exploit via a network request. Successful exploitation allows an attacker to read arbitrary files on the server's filesystem that the application process has permissions to access. The fix introduces a 'check_path_safety' utility to ensure requested paths remain within the designated sandbox. Patches are available in versions 15.109.0 and 16.19.0.

Affected products

  • Frappe Frappe < 15.109.0, >= 16.0.0-beta.1, < 16.19.0

Timeline

  • 2026-04-21: patched: Initial fix merged into develop branch
  • 2026-05-22: patched: Backported fixes merged into version 15 and 16 hotfix branches
  • 2026-07-10: disclosed: CVE published

References

Related threats