NVD CRITICAL: CVE-2026-119145 — Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnera...

Thursday, October 29, 2026 at 04:18 PM UTC·Source: NIST NVD

Updated: Thursday, October 29, 2026 at 05:00 PM UTC

Executive Summary

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-119145

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 29, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

DHS Strikes Back, Targeting 'Icepick' Leaks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/trump-administration-strikes-back-targeting-icepick-leaks-image_small-5-a-33249.jpg" align=right hspace=4>Icepi.cx Is Down But Icepicx.is Is Live

35m agoBank Info Security

MEDIUMVulnerabilityNEW

CISO Problems That Can't Be Solved With Technology

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ciso-problems-that-cant-be-solved-technology-image_small-4-a-33248.jpg" align=right hspace=4>Operational Struggles and Arrogant Vendors Mean Tool Churn Is Likely to Continue No matter how advanced or powerful cybersecurity tools become, they will never be able to fix many of the key problems that confront cyber defenders

35m agoBank Info Security

CRITICALVulnerability

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42 .

CVE-2026-109618CVE-2026-109619

1h agoUnit 42 (Palo Alto)