Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-39352

Frappe has an Arbitrary File Read via Path Traversal in render_include

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe frappe

  • < 15.105.0affected
  • >= 15.106.0, < 16.15.0affected

References