Frappe file upload handling wrote an uploaded file to a destination path without validating that path first. An authenticated user could place the write outside the storage directory.
Writing outside the storage directory can place a file where the application will execute it, which achieves remote code execution. The advisory rates the issue Critical at CVSS 9.9. VulnCheck scores the issue 9.4 under CVSS v4.0.
Frappe before 16.34.0 and before 15.121.0 is affected. The issue is patched in 16.34.0 and 15.121.0. The GitHub advisory was published on October 15, 2026; the CVE was published on October 29, 2026 via VulnCheck. This finding is in the Frappe framework, which is distinct from ERPNext.
Sequence
Attack path
01
Step 1
Sign in as an authenticated user.
02
Step 2
Upload a file whose destination path leaves the storage directory.
03
Step 3
Frappe writes the file to that destination without validating the path.
04
Step 4
The written file achieves remote code execution where the application executes it.
#poc
Proof of concept
On affected releases, an authenticated upload could write outside the storage directory. The same upload on 16.34.0 and 15.121.0 does not.
We will update this post at a later time to include additional proof of concept details. Operators should treat file upload handling on affected releases as in scope and upgrade.
#exploit
Exploitation
The primitive is an authenticated file write outside the storage directory. Where the written file is executed, the result is remote code execution.
The advisory rates the issue Critical at CVSS 9.9 with scope changed. VulnCheck scores the issue 9.4 under CVSS v4.0.
We will update this post at a later time to include additional exploitation details.
#details
Technical details
Root cause: file upload handling did not validate the destination path before writing to disk, which is a path traversal flaw classed as CWE-22.
Affected configuration: Frappe before 16.34.0 and before 15.121.0, for an authenticated user who can upload files.
The fix in 16.34.0 and 15.121.0 validates the destination path before the write.
Remediation
Fixed in Frappe 16.34.0 and 15.121.0.
Upgrade to Frappe 16.34.0 or 15.121.0 or later on your release line.
Until you can upgrade, limit file uploads to users you already trust, and check the storage directory and its parents for files that are not expected uploads.
How Submersion found it
01
Step 1
We will update this post at a later time to include proof of concept and exploitation details.
Basin was pointed at Frappe. It received the application and a running environment. It did not receive a vulnerability description, an exploit, a patch diff, or a prior disclosure.