Threats tagged 'ghsa-rh56-jwhr-hc9r'

Frappe versions before 15.121.0 and 16.x before 16.34.0 have a path traversal vulnerability in their file upload handling. This flaw allows authenticated attackers to upload files outside the intended storage directory, potentially leading to remote code execution on the server. The vulnerability is critical with a CVSS score of 9.9.