PT-2025-27460 · Frappe · Frappe

H41Th · Published 2025-06-30 · Updated 2025-06-30 · CVE-2025-52896

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.94.2 Frappe versions prior to 15.57.0

Description: The issue allows authenticated users to upload malicious files via Data Import, leading to cross-site scripting (XSS).

Recommendations: For versions prior to 14.94.2, upgrade to version 14.94.2 to prevent cross-site scripting attacks. For versions prior to 15.57.0, upgrade to version 15.57.0 to prevent cross-site scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52896

GHSA-HV29-66QG-2V6P

Affected Products

Frappe

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52896.json · Exploit
• https://github.com/frappe/frappe/commit/f11c53d4df745b58bd1c1c08e1634a2f5a55322a · Patch
• https://github.com/frappe/frappe/security/advisories/GHSA-hv29-66qg-2v6p · Vendor Advisory
• https://github.com/frappe/frappe/commit/152fd09de5bca16b8d299d715a1f5df6fca3866f · Patch
• https://osv.dev/vulnerability/CVE-2025-52896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52896 · Security Note
• https://github.com/frappe/frappe/pull/31483 · Note
• https://twitter.com/CveFindCom/status/1939740834343080433 · Twitter Post
• https://t.me/cvetracker/27449 · Telegram Post
• https://twitter.com/CVEnew/status/1939739415439433808 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1939766816672231523 · Twitter Post