Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Frappe
  • Frappe

No data.

No data.

References
Link Providers
https://github.com/frappe/frappe/commit/11066591ed7aa91a7b742f3f689277a90e620ce0 cve-icon
https://github.com/frappe/frappe/commit/46841f7fde3954e1d3b3a7e248a6d6022343e657 cve-icon
https://github.com/frappe/frappe/pull/38643 cve-icon
https://github.com/frappe/frappe/pull/39396 cve-icon
https://github.com/frappe/frappe/releases/tag/v16.18.3 cve-icon
https://github.com/frappe/frappe/security/advisories/GHSA-234v-jfr8-v2f8 cve-icon
History

Mon, 13 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe frappe
Vendors & Products Frappe
Frappe frappe

Fri, 10 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.
Title Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-07-10T21:20:36.507Z

Updated: 2026-07-13T17:58:54.127Z

Reserved: 2026-04-20T16:14:19.006Z

Link: CVE-2026-41482

cve-icon Vulnrichment

Updated: 2026-07-13T17:58:48.723Z

cve-icon NVD

No data.

cve-icon Redhat

No data.