Vulnerability in Frappe

CVE-2026-47182

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4.

EPSS: 0.003 (20.0th percentile) — read the EPSS interpretation.

Affected products

Frappe — versions < 16.17.4

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

security-advisories@github.com (x_refsource_CONFIRM)