HIGH 7.1 NVD
CVE-2026-109601
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Att
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.
References
- https://github.com/frappe/frappe/security/advisories/GHSA-8v98-cfpm-9p67
- https://www.vulncheck.com/advisories/frappe-framework-before-16.30.0-arbitrary-file-read-v
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-12 via NVD.
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.