CVE-2026-48127

Received Received - Intake

Improper File Attachment in Frappe Framework

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-48127

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	to 16.20.0 (exc)
frappe	frappe	to 15.110.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Frappe web application framework versions prior to 16.20.0 and 15.110.0. It allows users who do not have write access to attach files to any doctype through file-handling API endpoints such as add_attachments.

Essentially, unauthorized users could upload files where they should not be able to, due to insufficient access control on the file attachment APIs.

Impact Analysis

The impact of this vulnerability is that unauthorized users can attach files to documents they should not have permission to modify. This could lead to unauthorized data injection, potential storage of malicious files, or manipulation of document contents.

Such unauthorized file attachments could be exploited to compromise the integrity of the application data or to facilitate further attacks.

Mitigation Strategies

To mitigate this vulnerability, upgrade Frappe to version 16.20.0 or later, or 15.110.0 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-48127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70