The vulnerability stems from a path traversal flaw in Frappe's render_include function, which allows an attacker to read files outside the intended directory. By supplying specially crafted input, a malicious user could access arbitrary files on the server, potentially exposing sensitive configuration, credentials, or code. The issue is classified as CWE-22 and results in a data exposure risk for any application using the affected Frappe framework.

Frappe, the open‑source full‑stack web application framework, is affected for all releases before 15.105.0 and before 16.15.0. The remedial releases are 15.105.0 and 16.15.0 or later.

The vulnerability carries a CVSS score of 8.7, indicating high severity. No EPSS data is available, and the flaw is not listed in CISA's KEV catalog. Attackers would need to reach the vulnerable render_include endpoint, which typically requires composed URLs or form submissions. If the endpoint is publicly accessible, the path traversal can be triggered without authentication, making exploitation straightforward.