The vulnerability allows an attacker who can supply outgoing email content to inject an attribute value that points to a local file path, causing the server to expose sensitive files through the email HTML rendering process.

Frappe Framework is affected. All installations of version 15.117.0 and earlier, and 16.x versions before 16.30.0, are vulnerable. The issue resides in the email HTML handling component of the framework.

The CVSS score of 7.1 indicates a high risk to confidentiality. Exploitation requires an attacker able to control or influence outgoing email HTML content; this may be achieved by an authenticated user or compromised account with email-sending privileges. No current public exploits are documented and the attack is not listed in the CISA KEV catalog. The lack of an EPSS score means the overall likelihood of exploitation cannot be quantified, but the potential impact is significant if the attacker can craft such emails.