Path traversal is possible when using the /backups route in the download_backups feature. This flaw, identified as CWE‑22, allows a user to specify arbitrary file paths, potentially reading sensitive files from the server. If an attacker can reach this endpoint, they may obtain confidential configuration files, database credentials, or other critical data, leading to information disclosure and further compromise.

The vulnerability affects versions of the Frappe framework released before 16.19.0 and before 15.109.0. Users running any 16.x or 15.x release older than those specified are susceptible. The issue exists in the core Frappe codebase and is documented in the project's GitHub repository.

The CVSS score of 6.9 indicates moderate severity. EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed yet. The likely attack vector is through the publicly exposed /backups endpoint, which may be restricted to authenticated users; any user with access to that route can exploit the flaw. Because the flaw permits arbitrary file reads, the risk to confidentiality remains significant until a patch is applied.