CVE-2026-44440CWE-22

ERPNext: Path Traversal Leading to Sensitive File Exposure

Medium · published May 13, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability on an endpoint allows an authenticated adjacent attacker to read arbitrary files. This vulnerability is fixed in 15.101.1 and 16.10.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00598 · 47.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-13T21:12Z
EPSS history
Timeline
  • 13 MAY 21:12Z
    ERPNext: Path Traversal Leading to Sensitive File Exposure
    cvelistv5