Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00457.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Frappe Subscribe
Frappe Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Frappe Subscribe
Frappe Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc cve-icon cve-icon
https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d cve-icon cve-icon
https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326 cve-icon cve-icon
https://github.com/frappe/frappe/pull/38740 cve-icon cve-icon
https://github.com/frappe/frappe/pull/39402 cve-icon cve-icon
https://github.com/frappe/frappe/pull/39403 cve-icon cve-icon
https://github.com/frappe/frappe/releases/tag/v15.109.0 cve-icon cve-icon
https://github.com/frappe/frappe/releases/tag/v16.19.0 cve-icon cve-icon
https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj cve-icon cve-icon
History

Mon, 13 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe frappe
Vendors & Products Frappe
Frappe frappe

Fri, 10 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.
Title Frappe: Path Traversal via /backups Route
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-13T14:15:58.161Z

Reserved: 2026-04-25T05:04:37.029Z

Link: CVE-2026-42219

cve-icon Vulnrichment

Updated: 2026-07-13T14:15:53.633Z

cve-icon NVD

Status : Deferred

Published: 2026-07-10T22:16:41.550

Modified: 2026-07-13T18:05:36.130

Link: CVE-2026-42219

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T12:00:05Z

Weaknesses