Frappe File Upload Path Traversal Vulnerability

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability in its file-upload handling.

Certain file-upload handling does not validate the destination path before writing to disk.

• Authenticated attackers can upload crafted files to locations outside the intended storage directory.
• This can achieve remote code execution on the server.