Path Traversal Vulnerability in Frappe Framework Affects Multiple Versions

CVE-2026-42219

What is CVE-2026-42219?

The Frappe framework, a full-stack web application framework, contains a vulnerability that allows path traversal through the 'download_backups' feature due to insufficient security hardening. This flaw could potentially enable unauthorized users to access sensitive files stored on the server. To mitigate this risk, users are advised to upgrade to versions 16.19.0 or 15.109.0, where the vulnerability has been addressed. Keeping your software updated is crucial to safeguard applications from such security threats.

References