VULNERABILITY INTELLIGENCE

CVE-2025-30213

CVSS score8.8 HIGH
EPSS probability0.72%
CISA KEVNot currently listed
Published2025-03-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.

Weakness classification

  • security-advisories@github.com: CWE-20
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references