Path Traversal Vulnerability in ERPNext by Frappe

CVE-2026-44440

What is CVE-2026-44440?

ERPNext, an open-source Enterprise Resource Planning solution, is susceptible to a Path Traversal vulnerability. This flaw allows an authenticated adjacent attacker to read arbitrary files by exploiting the improper limitation of a pathname to a restricted directory. It is crucial for administrators to update their ERPNext installations to versions 15.101.1 or 16.10.0 or later to mitigate this issue and enhance their system's security.

References