CVE-2026-42219: Frappe Path Traversal Vulnerability

CVE-2026-42219 Overview

CVE-2026-42219 is a path traversal vulnerability [CWE-22] in Frappe, a full-stack Python and JavaScript web application framework. The flaw exists in the download_backups functionality due to insufficient path sanitization. Authenticated users with elevated privileges can request files outside the intended backup directory by supplying crafted path input. Frappe versions prior to 15.109.0 and 16.19.0 are affected. Maintainers addressed the issue in versions 15.109.0 and 16.19.0 by introducing a sandboxing utility that validates requested paths against a base directory.

Critical Impact
An authenticated attacker with high privileges can read arbitrary files accessible to the Frappe process, resulting in confidentiality loss across the host filesystem.

Affected Products

Frappe framework versions prior to 15.109.0 (v15 branch)
Frappe framework versions prior to 16.19.0 (v16 branch)
Applications built on Frappe that expose the download_backups endpoint

Discovery Timeline

2026-07-10 - CVE-2026-42219 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-42219

Vulnerability Analysis

The vulnerability resides in Frappe's download_backups handler, which serves database and file backups over HTTP. The handler accepted file identifiers without verifying that the resolved filesystem path remained within the designated backup directory. An attacker with sufficient privileges could supply relative path sequences such as ../ to escape the backup root and retrieve arbitrary files readable by the Frappe worker process.

Because the endpoint is reachable over the network and requires authentication with elevated privileges, exploitation is limited to authorized administrative users or accounts compromised through credential theft. Successful exploitation exposes configuration files, credentials, database dumps, and other host-resident data.

Root Cause

The root cause is the absence of canonical path validation. The pre-patch code did not compute the real path of the user-supplied filename or compare it against the real path of the backup base directory. Without this check, symbolic links and traversal sequences resolved outside the intended sandbox.

Attack Vector

The attack vector is network-based (AV:N) and requires high privileges (PR:H). The attacker sends an HTTP request to the download_backups route with a crafted path parameter that traverses parent directories. The server reads and returns the target file to the requester.

python

# Post-patch mitigation added to frappe/core/doctype/file/utils.py
def get_safe_file_name(file_name: str) -> str:
    return re.sub(r"[/\\%?#]", "_", file_name)


def check_path_safety(base_path: str, requested_path: str) -> bool:
    """Util to check path safety by ensuring sandboxing and logging unsuccessful attempts"""
    base_path = os.path.realpath(base_path)
    requested_path = os.path.realpath(requested_path)
    if os.path.commonpath([base_path, requested_path]) != base_path:
        frappe.log_error(
            title="Attempted Unauthorized File Access",
            message=f"Blocked access to: {requested_path}",
        )
        return False
    return True

Source: Frappe Commit 4358f5b

The patch resolves both the base directory and the requested path using os.path.realpath, then confirms the requested path is a descendant of the base directory via os.path.commonpath. Any mismatch triggers an error log entry and blocks the request.

Detection Methods for CVE-2026-42219

Indicators of Compromise

HTTP requests to the download_backups endpoint containing ../, encoded traversal sequences such as %2e%2e%2f, or absolute path prefixes.
Frappe error log entries with the title Attempted Unauthorized File Access after upgrading to a patched version.
Backup download activity originating from administrator accounts at unusual hours or from unexpected source IP addresses.

Detection Strategies

Inspect web server and reverse proxy access logs for download_backups requests that include path traversal characters or reference filenames outside the standard backup naming convention.
Correlate elevated-privilege session activity with file download volume to identify administrative account compromise.
Alert on any file responses served from paths outside the configured Frappe sites/*/private/backups directory.

Monitoring Recommendations

Enable Frappe's frappe.log_error sink and forward entries to a centralized logging platform for retention and search.
Track outbound response sizes on the download_backups route to identify anomalous file retrievals.
Monitor administrator role assignments and audit any newly granted System Manager or equivalent privileges.

How to Mitigate CVE-2026-42219

Immediate Actions Required

Upgrade Frappe to version 15.109.0 or 16.19.0 or later using bench update or the appropriate deployment workflow.
Rotate any credentials, API keys, or secrets that may have resided in files accessible to the Frappe process if unauthorized downloads are suspected.
Review administrator and System Manager accounts and disable any that are unused or unrecognized.

Patch Information

The fix ships in Frappe Release v15.109.0 and Frappe Release v16.19.0. The changes introduce the check_path_safety utility across frappe/core/doctype/file/utils.py and integrate it into frappe/utils/response.py. Full context is available in the Frappe Security Advisory GHSA-w4p4-fp9m-47gj and Pull Request #38740, with backports in Pull Request #39402 and Pull Request #39403.

Workarounds

Restrict the download_backups endpoint at the reverse proxy layer, allowing access only from trusted management IP ranges.
Enforce least privilege by removing System Manager rights from accounts that do not require backup access.
Require multi-factor authentication for all administrative Frappe accounts to reduce risk of credential-based exploitation.

bash

# Upgrade Frappe using bench to a patched release
bench update --reset
bench --site all migrate

# Verify installed version meets or exceeds the patched releases
bench version | grep frappe
# Expected: frappe 15.109.0 (or) frappe 16.19.0 or newer