What’s Vulnerable › Vulnerabilities

CVE-2026-39352: Frappe has an Arbitrary File Read via Path Traversal in render_include

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-20 · updated 2026-07-23
• Weakness: CWE-22

Description

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

Affected products

• frappe: before 15.105.0; from 15.106.0, < 16.15.0

References

• https://github.com/frappe/frappe/releases/tag/v16.15.0
• https://github.com/frappe/frappe/security/advisories/GHSA-67rf-pxgh-vfqv

Get alerted when CVE-2026-39352 or the next vulnerability affects your stack