PT-2025-48550 · Frappé Technologies · Frappe

Published 2025-12-01 · Updated 2025-12-04 · CVE-2025-66206

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.86.0 Frappe versions prior to 14.99.2

Description Frappe, a full-stack web application framework, had requests vulnerable to path traversal attacks in versions prior to 15.86.0 and 14.99.2. This allowed retrieval of server files if the full path was known. Sites hosted on Frappe Cloud and setups using a reverse proxy like NGINX were not affected. The issue primarily impacted those directly using werkzeug/gunicorn.

Recommendations Upgrade to Frappe version 15.86.0. Upgrade to Frappe version 14.99.2. If upgrading is not immediately possible, change the setup to use a reverse proxy like NGINX.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-66206

GHSA-V4WG-GQFR-RPJM

Affected Products

Frappe

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66206.json · Exploit
• https://github.com/frappe/frappe/security/advisories/GHSA-v4wg-gqfr-rpjm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66206 · Security Note
• https://twitter.com/CVEnew/status/1995596445806633312 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995719703193338213 · Twitter Post
• https://twitter.com/dailycve/status/1996678127335227898 · Twitter Post
• https://t.me/CVEtracker/38585 · Telegram Post