CVE-2026-39352

High

Published: 20 May 2026

Published

20 May 2026

Modified

21 May 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0128 66.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-39352 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Frappe, a full-stack web application framework, is affected by an arbitrary file read vulnerability via path traversal in all versions prior to 15.105.0 and 16.15.0. The flaw is tracked as CWE-22 and carries a CVSS 4.0 score of 8.7, reflecting network-accessible attack conditions with no authentication or user interaction required and high impact on confidentiality.

An unauthenticated remote attacker can supply crafted paths to traverse directories and retrieve arbitrary files from the underlying server, exposing sensitive configuration data, source code, or other restricted content without any privileges.

The official GitHub security advisory GHSA-67rf-pxgh-vfqv and the corresponding release notes for v16.15.0 and v15.105.0 state that the vulnerability has been resolved in those versions and recommend immediate upgrade for affected deployments.

The associated EPSS score has remained flat at 0.0355 with no material increase since disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-31178

Vulnerability details

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing web framework directly enables exploitation of the app (T1190) and arbitrary local file reads (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0