Is there a patch available for EUVD-2026-43103?

Yes, a patch is available for EUVD-2026-43103. Update the affected software to the latest version immediately.

Frappe Framework EUVD-2026-43103

Q: What is the CVSS score of EUVD-2026-43103?

EUVD-2026-43103 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-41482 HIGH

Path Traversal (CWE-22)

2026-07-10 GitHub_M

Path Traversal Google Frappe

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remotely reachable low-complexity request needing a low-privilege authenticated account (PR:L); path traversal yields high confidentiality file disclosure only, so I:N/A:N and scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 23:02 EUVD

Analysis Generated

Jul 10, 2026 - 21:56 vuln.today

CVE Published

Jul 10, 2026 - 21:20 cve.org

HIGH 7.1

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.

AnalysisAI

Local file inclusion in the Frappe Framework's Chrome PDF Generator (versions prior to 16.18.3) allows an authenticated user to abuse the 'secure local resource access' mechanism to traverse the filesystem and read arbitrary local files on the server. The flaw is a CWE-22 path traversal disclosed via GitHub Security Advisory GHSA-234v-jfr8-v2f8 and carries a CVSS 4.0 base score of 7.1 (VC:H - confidentiality-only impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector with only low privileges makes it a meaningful information-disclosure risk on multi-tenant deployments.

Technical ContextAI

Frappe is a Python-based full-stack web application framework and the foundation for ERPNext and other business applications. The affected component is its Chrome/Chromium-headless PDF generation feature, which renders HTML documents into PDFs and includes a 'secure local resource access' path to load local assets (images, stylesheets, fonts) referenced by the template. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the resource-resolution logic fails to properly canonicalize or confine the requested path within an allowed base directory, so sequences such as '../' or absolute paths escape the intended asset root and cause the headless browser to include arbitrary server-side files into the rendered output. The single affected CPE is cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*, with the fix landing in release v16.18.3 via PRs 38643 and 39396 and commits 11066591 and 46841f7f.

RemediationAI

Vendor-released patch: upgrade Frappe Framework to version 16.18.3 or later, which contains the fix delivered through PRs https://github.com/frappe/frappe/pull/38643 and https://github.com/frappe/frappe/pull/39396 and commits 11066591ed7aa91a7b742f3f689277a90e620ce0 and 46841f7fde3954e1d3b3a7e248a6d6022343e657; the release is at https://github.com/frappe/frappe/releases/tag/v16.18.3 and details are in advisory GHSA-234v-jfr8-v2f8. If immediate patching is not possible, reduce exposure by restricting who can trigger PDF generation - tighten role permissions so only trusted users hold accounts that can invoke print/PDF workflows (accepting that this limits legitimate PDF use), avoid rendering user-controlled or untrusted HTML templates through the Chrome PDF Generator, and consider switching print formats to the non-Chrome (wkhtmltopdf) generator or running the headless Chrome process under a hardened, least-privilege OS account and container so any file read is confined to non-sensitive paths. Monitor application logs for anomalous local-resource paths containing traversal sequences as a detection stopgap.