Is there a patch available for CVE-2026-42219?

Yes, a patch is available for CVE-2026-42219. Update the affected software to the latest version immediately.

Frappe Framework CVE-2026-42219

Q: What is the CVSS score of CVE-2026-42219?

CVE-2026-42219 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-43106 MEDIUM

Path Traversal (CWE-22)

2026-07-10 GitHub_M

Path Traversal Frappe

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Network-accessible endpoint with low complexity, but PR:H required; confidentiality-only impact with no integrity or availability consequence and no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 23:02 EUVD

Analysis Generated

Jul 10, 2026 - 22:21 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

AnalysisAI

Path traversal via the download_backups endpoint in Frappe framework exposes arbitrary server-side files to authenticated high-privilege users. Affected versions span the entire v15 branch prior to 15.109.0 and the v16 branch prior to 16.19.0 (CPE: cpe:2.3:a:frappe:frappe:*). An attacker holding administrator-level credentials can craft a traversal payload in the backup download request to read files outside the intended backup directory, achieving high confidentiality impact with no integrity or availability consequence. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Frappe is a Python-based full-stack web application framework primarily known as the foundation for ERPNext and related FOSS business applications. The vulnerable component is the download_backups function, which handles file serving of database and file backups without sufficient path hardening - a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) root cause. The absence of canonical path resolution or allowlist validation before file I/O allows sequences such as '../../../etc/passwd' or similar traversal strings to escape the intended backup storage directory. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H) confirms the endpoint is network-accessible with low attack complexity, but exploitation is gated behind high-privilege authentication, suggesting the download_backups feature is exposed within the authenticated Frappe desk (admin panel) rather than as a public-facing API. Three separate fix commits (4358f5b, a470a11, a562ef2) across multiple PRs (#38740, #39402, #39403) indicate the hardening was applied in stages across both maintained release branches.

RemediationAI

Upgrade Frappe to version 16.19.0 (v16 branch) or 15.109.0 (v15 branch); these are the vendor-confirmed fixed releases per GitHub advisory GHSA-w4p4-fp9m-47gj (https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj). For deployments using bench, run 'bench update --branch version-16' or the appropriate branch. If an immediate upgrade is not feasible, restrict access to the Frappe administrator role to only fully trusted internal users, and consider placing the Frappe desk behind VPN or IP allowlisting to reduce the network attack surface - noting that this compensating control does not eliminate the vulnerability, only raises the bar for reaching it. Operators on unsupported branches (v14 and earlier) should prioritize migration to a supported branch or apply the upstream patch commits manually: 4358f5bd449710027724a1679950d4ea65da6dcc, a470a1189132984635e2ec148f87de5232f5535d, and a562ef2a5a3885895b9f9cf14d5a53e32e52d326.