Frappe - Path Traversal (CVE-2026-39352)

CVE-2026-39352 is a high-severity path traversal vulnerability in the Frappe web application framework, affecting versions prior to 15.105.0 and 16.15.0. This flaw allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information and configuration data. Exploitation of this vulnerability could lead to significant data breaches or further compromise of affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-39352 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the /api/resource/Report endpoint by injecting path traversal payloads into the javascript field using {% include '<traversal>' %} syntax, enabling arbitrary file reads when subsequently accessing /api/method/frappe.desk.query_report.get_script.