Which versions of Frappe Framework are affected by EUVD-2026-31178?

Frappe framework versions prior to 15.105.0 and 16.15.0 are vulnerable to unauthenticated path traversal attacks that allow remote adversaries to read arbitrary files, including credentials and…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-31178?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31178. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31178?

Within 24 hours: Audit all Frappe installations to identify versions prior to 15.105.0 and 16.15.0; prioritize internet-exposed instances. Within 7 days: Implement web application firewall rules blocking path traversal sequences (../, encoded variants); restrict file system permissions on sensitive configuration files (site_config.json, etc.); rotate all credentials (database passwords, API keys, encryption keys). Within 30 days: Monitor Frappe project release notes for patch availability targeting versions 15.105.0, 16.15.0 or later; execute staged upgrades on test instances.

Frappe Framework EUVD-2026-31178

Q: What is the CVSS score of EUVD-2026-31178?

EUVD-2026-31178 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-39352 HIGH

Path Traversal (CWE-22)

2026-05-20 GitHub_M

Path Traversal Frappe

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 20, 2026 - 21:32 EUVD

Source Code Evidence Fetched

May 20, 2026 - 20:31 vuln.today

Analysis Generated

May 20, 2026 - 20:31 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.7 (HIGH)

DescriptionGitHub Advisory

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

AnalysisAI

Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrieve files outside intended directories via path traversal sequences in affected versions prior to 15.105.0 and 16.15.0. The CVSS 4.0 base score of 8.7 reflects high confidentiality impact with no required privileges or user interaction, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Successful exploitation discloses sensitive server-side files such as configuration secrets, site keys, or credentials used by downstream ERPNext deployments.

Technical ContextAI

Frappe is a Python/JavaScript metadata-driven web framework that underpins ERPNext and numerous business applications, exposing file-serving and document-attachment endpoints over HTTP. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., 'Path Traversal'), meaning user-controlled input used in a file-path operation is not adequately canonicalized or constrained to a safe base directory, allowing '../' or absolute-path sequences to escape the intended root. The affected component is identified by CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* covering all Frappe builds before the patched releases, and the upstream advisory GHSA-67rf-pxgh-vfqv tracks the remediation across the 15.x and 16.x maintenance branches.

RemediationAI

Vendor-released patch: upgrade to Frappe 16.15.0 (16.x branch) or 15.105.0 (15.x maintenance branch) or later, as documented in the GitHub Security Advisory at https://github.com/frappe/frappe/security/advisories/GHSA-67rf-pxgh-vfqv and the release notes at https://github.com/frappe/frappe/releases/tag/v16.15.0. For self-hosted instances using bench, run 'bench update --patch' or pin the branch to version-15 / version-16 and pull the tagged release, then restart supervisor and nginx. If immediate patching is not feasible, place the Frappe site behind a WAF or reverse-proxy rule that rejects request paths containing '..%2f', '%2e%2e/', encoded null bytes, or absolute filesystem paths in query/body parameters used by file-serving endpoints (e.g., /api/method/frappe.utils.file_manager.* and /private/files/*); be aware this can break legitimate apps that intentionally embed dotted paths and will not catch novel traversal encodings the framework itself accepts. Additionally restrict network exposure of admin and file endpoints to VPN/IP-allowlisted ranges, and rotate site_config.json secrets (db, encryption_key, admin password) after patching in case prior exploitation occurred.