CVEvulnerability

CVE-2025-68929

9.0 CRITICAL Published 2025-12-29 Modified 2026-10-13 Official page ↗
Status
Analyzed
Published
2025-12-29
Last modified
2026-10-13
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-1336

Description

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

Affected configurations

• frappe frappe (< 14.99.6) • frappe frappe (>= 15.0.0 < 15.88.1)

Related

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References