VULNERABILITY INTELLIGENCE

CVE-2025-68929

CVSS score9 CRITICAL
EPSS probability0.50%
CISA KEVNot currently listed
Published2025-12-29
Last modified2026-10-13
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Description

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

Weakness classification

  • security-advisories@github.com: CWE-1336

Primary references