# CVE-2026-39352: Frappe - Path Traversal

> Live exploitation tracking for CVE-2026-39352 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-39352

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** Frappe
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** web_application, python

## Description

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

## CrowdSec analysis

[CVE-2026-39352](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-39352) is a high-severity path traversal vulnerability in the Frappe web application framework, affecting versions prior to 15.105.0 and 16.15.0. This flaw allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information and configuration data. Exploitation of this vulnerability could lead to significant data breaches or further compromise of affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-39352 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/api/resource/Report` endpoint by injecting path traversal payloads into the `javascript` field using `{% include '<traversal>' %}` syntax, enabling arbitrary file reads when subsequently accessing `/api/method/frappe.desk.query_report.get_script`.

## Timeline

- 2026-05-20: CVE Published. CVE-2026-39352 is published to NVD.
- 2026-06-03: Rule Released. CrowdSec releases a rule to detect CVE-2026-39352 exploitation attempts against the CrowdSec Network.
- 2026-06-10: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-39352 for the first time.

## References

- https://github.com/frappe/frappe/security/advisories/GHSA-67rf-pxgh-vfqv
- https://github.com/frappe/frappe/releases/tag/v16.15.0
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39352.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-39352) follows observed exploitation activity for CVE-2026-39352. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.