Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00457.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
frappe frappe affected
Version Status Constraints
< 15.109.0 affected —
>= 16.0.0-beta.1, < 16.19.0 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Frappe Subscribe
Frappe Subscribe

Project Subscriptions

Vendors Products
Frappe Subscribe
Frappe Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc cve-icon
https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d cve-icon
https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326 cve-icon
https://github.com/frappe/frappe/pull/38740 cve-icon
https://github.com/frappe/frappe/pull/39402 cve-icon
https://github.com/frappe/frappe/pull/39403 cve-icon
https://github.com/frappe/frappe/releases/tag/v15.109.0 cve-icon
https://github.com/frappe/frappe/releases/tag/v16.19.0 cve-icon
https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj cve-icon
History

Mon, 13 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe frappe
Vendors & Products Frappe
Frappe frappe

Fri, 10 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.
Title Frappe: Path Traversal via /backups Route
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-13T14:15:58.161Z

Reserved: 2026-04-25T05:04:37.029Z

Link: CVE-2026-42219

cve-icon Vulnrichment

Updated: 2026-07-13T14:15:53.633Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-25T19:45:03Z

Weaknesses