PT-2026-7328 · Frappe · Frappe

Stolichnayer · CVE-2026-25956 · Published 2026-02-10 · Updated 2026-02-10

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.99.14 Frappe versions prior to 15.94.0

Description A crafted malicious signup URL for a Frappe site could lead to an open redirect or reflected cross-site scripting (XSS), depending on the crafted payload, when a user signs up. The issue occurs when a user accesses a specially designed URL.

Recommendations Update to Frappe version 14.99.14 or later. Update to Frappe version 15.94.0 or later.

Exploit

Fix

Open Redirect

XSS

Weakness Enumeration

CWE-601

CWE-79

Related Identifiers

CVE-2026-25956

GHSA-7M8V-G2PR-H2F7

Affected Products

Frappe

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25956.json · Exploit
• https://github.com/frappe/frappe/commit/22cac9dd240dc1fa00d4bab7e3887b70faf22bd1 · Patch
• https://github.com/frappe/frappe/security/advisories/GHSA-7m8v-g2pr-h2f7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25956 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25956 · Vendor Advisory
• https://t.me/CVEtracker/44317 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021367871843033329 · Twitter Post