Frappe Framework CVE-2026-109601

Exploitation requires an authenticated account with the ability to supply or control outgoing email HTML content in Frappe Framework (hence PR:L) - for example a user role permitted to compose or configure outgoing email/notification templates. The attacker sets an HTML attribute value to a local server file path, which the framework dereferences during outgoing-email processing. Limiting factors: the attacker must already hold a privileged-enough account to author outgoing email content (not fully unauthenticated), impact is confined to reading files readable by the Frappe service account, and affected instances must run versions before 15.117.0 or 16.x before 16.30.0; no user interaction by a victim is required.

This is a moderate-priority authenticated information-disclosure flaw, not a drop-everything emergency, but it warrants prompt patching. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) is internally consistent with the description: the vulnerability is network-reachable with low complexity, requires some privilege (PR:L - a user able to supply outgoing email content), needs no user interaction, and yields high confidentiality impact with no integrity or availability effect - matching CWE-73 (external control of filename/path) leading to arbitrary file read. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data supplied; per precision rules this is 'no public exploit identified at time of analysis.' The key limiting signal is PR:L: exploitation is gated behind an account that can author/send outgoing email, which meaningfully narrows the attacker population versus a fully unauthenticated bug and argues against mass, internet-wide automation. There is no conflict between the CVSS vector and the description - both point to authenticated network access with confidentiality-only impact. The main missing data are EPSS, KEV, and POC status, all of which are simply absent rather than contradictory.

A low-privileged but authenticated Frappe user (or an attacker who has compromised such an account) composes or configures outgoing email content and sets an HTML attribute to reference a local server file path. When the framework processes the outgoing HTML, it reads the referenced file and embeds/exposes its contents, letting the attacker exfiltrate sensitive server files such as configuration or credential material. No public exploit code was identified at time of analysis, but the technique is straightforward given the low attack complexity.