CVEvulnerability
CVE-2025-65267
9.0 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-79
Description
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
Affected configurations
• frappe erpnext 15.83.2
• frappe frappe 15.86.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/PhDg1410/CVE/tree/main/CVE-2025-65267 Third Party Advisory
- https://github.com/frappe/erpnext Product
- https://github.com/frappe/frappe Product