PT-2026-57312 · Frappe · Frappe

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-42219

NVD

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-42219

Produtos afetados

Frappe

Referências · 10

• https://github.com/frappe/frappe/releases/tag/v16.19.0 · Nota
• https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326 · Nota
• https://github.com/frappe/frappe/pull/38740 · Nota
• https://github.com/frappe/frappe/pull/39402 · Nota
• https://github.com/frappe/frappe/pull/39403 · Nota
• https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj · Nota
• https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc · Nota
• https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d · Nota
• https://github.com/frappe/frappe/releases/tag/v15.109.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42219 · Nota de Segurança