Frappe Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in the Frappe web application framework, specifically in versions 14.99.5 and earlier, as well as 15.0.0 through 15.80.1. This vulnerability allows arbitrary files from the server to be accessed and read, due to inadequate sanitization of certain requests. The issue arises in the middleware that handles file requests, where the absence of proper validation enables attackers to exploit the path traversal flaw and retrieve sensitive files from the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access and reading of arbitrary files on the server, potentially including sensitive information.

Remediation

Users can upgrade to Frappe versions 14.99.6 or 15.88.1, where this vulnerability has been patched. For those unable to upgrade, it is recommended to change the setup to use a reverse proxy, such as NGINX.