PT-2026-23507 · Frappe · Frappe

Tepel-Chen · Published 2026-03-05 · Updated 2026-03-10 · CVE-2026-28436

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.11.0 and 15.102.0

Description A flaw exists in Frappe that allows an attacker to inject malicious code through a crafted image URL. This can lead to Cross-Site Scripting (XSS) when a user’s avatar is displayed. The issue can be triggered for other users through website page comments.

Recommendations Update to version 16.11.0 or later. Update to version 15.102.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28436

GHSA-VM63-R48G-7WQH

Affected Products

Frappe

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28436.json · Exploit
• https://github.com/frappe/frappe/security/advisories/GHSA-vm63-r48g-7wqh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28436 · Security Note
• https://twitter.com/VulmonFeeds/status/2029687040841830590 · Twitter Post
• https://twitter.com/CVEnew/status/2030385212840935758 · Twitter Post
• https://twitter.com/dailycve/status/2031172841484304597 · Twitter Post