CVE-2026-109601
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read…
- Risk score
- 43/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.
- Affected
- See advisory
- Fix
- Upgrade the product to 15.117.0 or 16.30.0 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.
Last activity 12 Oct 2026. Patch Forecast updates every hour.