PT-2025-27461 · Frappe · Frappe

Houssam Drissi · Published 2025-06-30 · Updated 2025-06-30 · CVE-2025-52898

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.94.3 Frappe versions prior to 15.58.0

Description: A carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This issue can only be exploited on self-hosted instances configured in a certain way. Frappe Cloud users are not affected.

Recommendations: For self-hosted users, upgrade to version 14.94.3 or later. For self-hosted users, upgrade to version 15.58.0 or later. As a temporary workaround, consider verifying password reset URLs before clicking on them.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-52898

GHSA-P284-R7RH-WQ7J

Affected Products

Frappe

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52898.json · Exploit
• https://github.com/frappe/frappe/commit/52e31337a6c964189c8b883a2f7bc3a28ab374f2 · Patch
• https://github.com/frappe/frappe/commit/5b4849b1ab5fd796b306312745b4e202b0e90d66 · Patch
• https://github.com/frappe/frappe/security/advisories/GHSA-p284-r7rh-wq7j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52898 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52898 · Vendor Advisory
• https://github.com/frappe/frappe/pull/31522 · Note
• https://t.me/cvetracker/27452 · Telegram Post
• https://twitter.com/CveFindCom/status/1939740808736800775 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1939759137199452226 · Twitter Post
• https://twitter.com/CVEnew/status/1939743678622503128 · Twitter Post