PT-2025-48816 · Frappé Technologies · Frappe Framework+1

Published 2025-12-03 · Updated 2025-12-08 · CVE-2025-65267

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ERPNext version 15.83.2 Frappe Framework version 15.86.0

Description Improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected instance.

Recommendations Update ERPNext to a version newer than 15.83.2. Update Frappe Framework to a version newer than 15.86.0.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65267

Affected Products

Erpnext

Frappe Framework

References · 9

• 🔥 https://github.com/PhDg1410/CVE/tree/main/CVE-2025-65267 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65267 · Security Note
• https://github.com/frappe/erpnext · Note
• https://github.com/frappe/frappe · Note
• https://t.me/CVEtracker/38757 · Telegram Post
• https://twitter.com/dailycve/status/1997047548637598138 · Twitter Post
• https://t.me/cveNotify/144926 · Telegram Post
• https://twitter.com/cracbot/status/1997984554326573351 · Twitter Post