What is the CVSS score of CVE-2026-44440?

CVE-2026-44440 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44440?

Yes, a patch is available for CVE-2026-44440. Update the affected software to the latest version immediately.

ERPNext CVE-2026-44440

EUVD-2026-30193 MEDIUM

Path Traversal (CWE-22)

2026-05-13 GitHub_M

Path Traversal Erpnext

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:13 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability on an endpoint allows an authenticated adjacent attacker to read arbitrary files. This vulnerability is fixed in 15.101.1 and 16.10.0.

AnalysisAI

Path traversal in ERPNext exposes arbitrary server files to authenticated low-privileged users via a vulnerable endpoint that fails to restrict directory access. Affected versions are ERPNext prior to 15.101.1 and the 16.x beta line prior to 16.10.0, packaged under CPE cpe:2.3:a:frappe:erpnext. An attacker with a valid account can craft a request to read sensitive files outside the intended directory scope, resulting in full confidentiality compromise of the host filesystem. No public exploit identified at time of analysis, and CISA SSVC signals no active exploitation.

Technical ContextAI

ERPNext is an open-source ERP platform developed by Frappe (CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. A server-side endpoint fails to normalize or validate user-supplied path input before using it to access the filesystem, allowing sequences such as '../' to escape the intended restricted directory. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the vulnerability is reachable over the network with no user interaction and with only low-level authenticated access - consistent with a standard logged-in ERPNext user account. The impact is limited to confidentiality (C:H); there is no write or execution primitive indicated.

RemediationAI

The primary fix is to upgrade ERPNext to version 15.101.1 (stable branch) or 16.10.0 (16.x branch), both confirmed as patching this vulnerability by the vendor advisory at https://github.com/frappe/erpnext/security/advisories/GHSA-6ffr-92hr-3394. If immediate upgrade is not possible, restrict access to the affected endpoint at the web server or reverse proxy layer (e.g., deny requests containing path traversal sequences such as '../' or URL-encoded equivalents '%2e%2e' via WAF or nginx rules) - note this may break legitimate functionality if the endpoint serves normal use cases, so test thoroughly before deploying. Additionally, minimize the number of user accounts holding ERPNext login access, particularly on internet-exposed instances, to reduce the authentication surface an attacker could leverage.