Frappe Framework EUVD-2026-36495

Exploitation requires a valid authenticated session in the Frappe application at any privilege level (PR:L per the CVSS 4.0 vector). The attacker must be able to guess or enumerate private file paths - files stored with predictable naming patterns (e.g., sequential IDs, original upload filenames) are most at risk, while files using high-entropy random identifiers are harder to enumerate. No special feature needs to be enabled; the vulnerability exists in the default file-serving behavior of all pre-16.17.4 Frappe deployments. The key limiting factors are: (1) authentication is required before exploitation - anonymous users cannot exploit this, and (2) success depends on the attacker's ability to predict file paths, meaning randomly named files with UUIDs provide incidental hardening but do not constitute a security control.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) places this as a low-complexity, network-accessible vulnerability with limited confidentiality impact and no integrity or availability consequences - consistent with an unauthorized file read rather than code execution. Authentication is required (PR:L), which restricts the attacker pool to credentialed users of the application. EPSS at 0.02% (7th percentile) signals very low observed exploitation probability in the wild, and the CVE has no CISA KEV listing and no known public exploit code. The overall real-world risk is moderate: the vulnerability is easy to exploit once authenticated, but the impact is limited to file disclosure and the requirement for prior authentication meaningfully limits the attack surface. For multi-tenant Frappe deployments or those handling sensitive uploaded documents, this should be patched promptly; for single-tenant or low-data-sensitivity deployments, urgency is lower.

An attacker with a valid low-privileged Frappe account - such as a standard portal user or a recently onboarded employee - constructs direct HTTP GET requests to private file paths by enumerating predictable Frappe file storage URL patterns. By iterating over known path structures and filenames observed through other application interactions, the attacker retrieves private documents such as invoices, HR records, or configuration attachments that are intended to be restricted to authorized roles. No public exploit code has been identified at time of analysis, but the low attack complexity means no specialized tooling is required beyond a standard HTTP client.