CVE-2026-119145
Last modified
CVE-2026-119145 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server..
Description
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-119145?
How severe is CVE-2026-119145?
How do I fix CVE-2026-119145?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11914vulnerability in Drupal Composer allows . This issue affects…5.9
- CVE-2026-119140Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 conta…4.8
- CVE-2026-119141Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 conta…5.3
- CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 conta…4.8
- CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 conta…4.8
- CVE-2026-119144Frappe Framework before 15.111.0 and 16.x before 16.21.0 con…8.8
- CVE-2026-119146ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overfl…5.6
- CVE-2026-119147ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorizatio…4.3
- CVE-2026-119148Incomplete string validation in AWS aws-nitro-enclaves-sdk-c…6.5
- CVE-2026-11915vulnerability in Drupal Brute force attack protection allows…5.9
- CVE-2026-119160The Smart Post – Post Grid, Post Carousel, Post Slider Guten…6.4
- CVE-2026-119162The User Submitted Posts – Enable Users to Submit Posts from…7.2
Are you affected by CVE-2026-119145?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST