CRITICALCVSS v3.1 9.9Vulnerability

CVE-2026-119145

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Properties

Severity
CRITICAL
Nvd fetched at
2026-10-29T19:54:00.882258+00:00
Cvss score
9.9
Cvss severity
CRITICAL
Retrieved at
2026-10-29T19:54:43+00:00
Score
9.9
Last source
NVD
Cvss version
3.1
Cve id
CVE-2026-119145
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
First seen by Signal
2026-10-29T19:54:43+00:00
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published at
2026-10-29T16:18:08.277
Last modified
2026-10-29T17:18:08.053

Related Entities (1)

HAS_WEAKNESS (1)

→[Weakness]Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-119145 (CVSS v3.1 9.9) — Ninja Signal Threat Intelligence | Ninja Signal