Frappe, a full-stack web application framework, allows users who do not have write permission to attach files to any doctype via API endpoints such as add_attachments or upload_file. This broken access control flaw (CWE‑862) permits an attacker to persist arbitrary files within the system, potentially exposing sensitive data or facilitating further compromise.

All Frappe framework releases prior to version 16.20.0 and 15.110.0 are affected. The vulnerability exists in every older release where the file‑handling API does not enforce proper write permissions.

The flaw carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is < 1%, reflecting a minimal likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. The likely attack vector is via the web API; an attacker must be able to send requests to add_attachments or upload for access. Once exploited, the attacker can inject files that remain accessible, potentially leading to data leakage or serving as a foothold for further attacks.