PT-2026-42259 · Erpnext+1 · Erpnext+1

Pucagit · CVE-2026-39352 · Published 2026-05-20 · Updated 2026-05-25

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.105.0 Frappe versions prior to 16.15.0

Description Frappe, a full-stack web application framework, contains a path traversal issue that may allow unauthenticated arbitrary file read on internet-facing surfaces, such as ERPNext. Over 115,700 potentially affected devices have been identified worldwide. Path traversal is a technique where an attacker uses special characters to access files and directories outside the intended folder.

Recommendations Update to version 15.105.0 or above. Update to version 16.15.0 or above.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39352

GHSA-67RF-PXGH-VFQV

Affected Products

Erpnext

Frappe

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39352.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-39352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39352 · Security Note
• https://github.com/frappe/frappe/releases/tag/v16.15.0 · Note
• https://github.com/frappe/frappe/security/advisories/GHSA-67rf-pxgh-vfqv · Note
• https://twitter.com/fofabot/status/2058751473165750711 · Twitter Post