The vulnerability allows an attacker with valid credentials to craft a file upload that includes a path traversal sequence. The application fails to validate the destination path, enabling the attacker to write the uploaded file to an arbitrary location on the server’s file system, thereby executing malicious code. This leads directly to full remote code execution and compromise of the affected server.

The flaw affects the Frappe framework version 15.x prior to 15.121.0 and all 16.x releases before 16.34.0. The affected product is Frappe Frappe. "Frappe 15.x" versions earlier than 15.121.0 and "Frappe 16.x" before 16.34.0 are vulnerable.

The CVSS score of 9.4 indicates critical severity, and the EPSS score is not available, while the vulnerability is not currently listed in the CISA KEV catalog. Because valid authenticated users can upload files, an attacker with valid credentials can immediately exploit the path traversal to place a malicious payload on the server, resulting in remote code execution. The vulnerability is a classic path traversal flaw (CWE-22).