CVE-2026-44440: ERPNext Path Traversal Vulnerability

CVE-2026-44440 Overview

CVE-2026-44440 is a path traversal vulnerability in ERPNext, a free and open source Enterprise Resource Planning (ERP) tool maintained by Frappe. The flaw exists in an application endpoint that fails to properly sanitize pathname input. An authenticated attacker with adjacent network access can exploit this weakness to read arbitrary files from the host filesystem. The issue is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Frappe addressed the issue in ERPNext versions 15.101.1 and 16.10.0. Administrators running earlier releases should upgrade to eliminate the exposure.

Critical Impact

Authenticated attackers can read arbitrary files accessible to the ERPNext process, potentially exposing configuration files, credentials, and business data.

Affected Products

• ERPNext versions prior to 15.101.1
• ERPNext versions prior to 16.10.0
• Frappe-hosted and self-managed ERPNext deployments

Discovery Timeline

• 2026-05-13 - CVE-2026-44440 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44440

Vulnerability Analysis

The vulnerability resides in an ERPNext endpoint that accepts a filename or path parameter without enforcing a restricted base directory. An attacker submits crafted input containing directory traversal sequences such as ../ to escape the intended directory. The application then resolves the manipulated path and returns the file contents to the caller.

Exploitation requires valid authentication and adjacent network positioning, which limits the pool of potential attackers. However, ERPNext deployments typically host sensitive business records, accounting data, and integration secrets. Successful exploitation yields read access to any file the ERPNext process can open, including site configuration files containing database credentials and API keys.

Root Cause

The root cause is missing or incomplete validation of user-supplied path components before file system access. The vulnerable handler concatenates input into a file path and invokes a read operation without canonicalizing the result against an allowed directory. This pattern matches CWE-22, where pathname inputs are not properly limited to a restricted directory.

Attack Vector

An authenticated user on an adjacent network sends a request to the vulnerable endpoint with a path parameter containing traversal sequences. The server resolves the path outside the intended directory and returns the file contents in the response. No user interaction is required beyond the attacker's own session, and exploitation does not require elevated privileges within the application.

Refer to the Frappe GitHub Security Advisory GHSA-6ffr-92hr-3394 for vendor-confirmed technical details.

Detection Methods for CVE-2026-44440

Indicators of Compromise

• HTTP requests to ERPNext endpoints containing path traversal sequences such as ../, ..%2f, or ..%5c in query parameters or request bodies.
• Application or web server logs showing successful responses for requests referencing files outside the standard ERPNext site directories.
• Unexpected access patterns to sensitive paths such as site_config.json, /etc/passwd, or private key files originating from the ERPNext service account.

Detection Strategies

• Inspect ERPNext and reverse proxy access logs for encoded and unencoded traversal patterns targeting file-serving endpoints.
• Correlate authenticated session activity with anomalous file-read response sizes that deviate from typical endpoint behavior.
• Deploy web application firewall (WAF) rules that flag path traversal payloads in parameters delivered to ERPNext routes.

Monitoring Recommendations

• Enable verbose request logging for ERPNext endpoints that accept file or path parameters until patches are applied.
• Alert on authenticated users issuing repeated requests with traversal patterns from a single session.
• Monitor the ERPNext service account for file reads outside expected site, app, and asset directories.

How to Mitigate CVE-2026-44440

Immediate Actions Required

• Upgrade ERPNext to version 15.101.1 or 16.10.0 or later without delay.
• Audit ERPNext user accounts and revoke unnecessary access, since exploitation requires authentication.
• Rotate credentials, API keys, and tokens stored in ERPNext site configuration files if exploitation is suspected.

Patch Information

Frappe published fixes in ERPNext 15.101.1 and 16.10.0. Upgrade instructions and version notes are available in the GitHub Security Advisory GHSA-6ffr-92hr-3394. Self-hosted deployments should use the standard bench update workflow, while cloud-hosted instances on Frappe Cloud receive updates from the vendor.

Workarounds

• Restrict network access to ERPNext to trusted segments and VPN-connected users to reduce adjacent attacker exposure.
• Place a WAF in front of ERPNext to block requests containing ..%2f, ..%5c, and similar traversal encodings.
• Limit filesystem permissions of the ERPNext service account so sensitive files outside the site directory are not readable.

# Configuration example: upgrade ERPNext using bench
bench update --reset
bench --site <site-name> migrate
bench version