CVE-2026-42219: Frappe: Path Traversal via /backups Route

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-10 · updated 2026-07-13
Weakness: CWE-22

Description

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

Affected products

frappe: before 15.109.0; from 16.0.0-beta.1, < 16.19.0

References

https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc
https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d
https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326
https://github.com/frappe/frappe/pull/38740
https://github.com/frappe/frappe/pull/39402
https://github.com/frappe/frappe/pull/39403
https://github.com/frappe/frappe/releases/tag/v15.109.0
https://github.com/frappe/frappe/releases/tag/v16.19.0
https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj

Get alerted when CVE-2026-42219 or the next vulnerability affects your stack