Path Traversal in Frappe Framework via Chrome PDF Generator

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-41482

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	full_stack_web_application_framework	to 16.18.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, update the Frappe full-stack web application framework to version 16.18.3 or later, where the issue has been fixed.

Executive Summary

This vulnerability exists in the Frappe full-stack web application framework prior to version 16.18.3. It involves possible path traversal and local file inclusion through the secure local resource access feature in the Chrome PDF Generator component.

Impact Analysis

The vulnerability could allow an attacker with limited privileges to perform path traversal and local file inclusion attacks. This means they might be able to access or include files on the local system that should not be accessible, potentially exposing sensitive information or enabling further attacks.

Hi! I’m here to help you understand CVE-2026-41482. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70