The vulnerability stems from a path traversal flaw in Frappe's render_include function, which allows an attacker to read files outside the intended directory. By supplying specially crafted input, a malicious user could access arbitrary files on the server, potentially exposing sensitive configuration, credentials, or code. The issue is classified as CWE-22 and results in a data exposure risk for any application using the affected Frappe framework.

Frappe, the open‑source full‑stack web application framework, is affected for all releases before 15.105.0 and before 16.15.0. The remedial releases are 15.105.0 and 16.15.0 or later.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score indicates a 3% likelihood of exploitation, and the flaw is not listed in CISA's KEV catalog. Attackers would need to reach the vulnerable render_include endpoint. Based on the description, it is inferred that reaching the endpoint may involve accessing specific URLs or form submissions. The likely attack vector is through crafted URLs or input that trigger the render_include function. If the endpoint were publicly accessible, the path traversal could be triggered without authentication, making exploitation straightforward.