Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-41482: Frappe PDF Generator could read unauthorized files
CVE-2026-41482 · published 3 months ago
Summary
The PDF creation feature in Frappe could be tricked into accessing files outside its intended folder, potentially exposing private data. This risk exists in versions before 16.18.3. Upgrade to version 16.18.3 or later to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| frappe | frappe | < 16.18.3 |
Original advisory text
Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator
Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.
References
- https://github.com/frappe/frappe/releases/tag/v16.18.3 URL
- https://github.com/frappe/frappe/security/advisories/GHSA-234v-jfr8-v2f8 Vendor Advisory
- https://github.com/frappe/frappe/commit/11066591ed7aa91a7b742f3f689277a90e620ce0 Patch
- https://github.com/frappe/frappe/commit/46841f7fde3954e1d3b3a7e248a6d6022343e657 Patch
- https://github.com/frappe/frappe/pull/38643 Patch
- https://github.com/frappe/frappe/pull/39396 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41482... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41482 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-22Path Traversal
Timeline
Published10 Jul 2026
Updated4 Nov 2026
First seen10 Jul 2026
Track software like this
Free during beta