Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 12, 2026 · NIST NVD

   Detected

   Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.

2. Oct 14, 2026 · NIST NVD

   Updated

   Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.

Sources

• CVE.orgVulnerability recordCVE-2026-109601

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-109601

  30-day exploitation probability 0.3%

  first.org
• NIST NVDVulnerability recordCVE-2026-109601

  Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitiv

  nvd.nist.gov

References

• Reference · github.com
• Reference · vulncheck.com