CVE-2025-30213
Frappe has Possibility of Remote Code Execution due to improper validation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Frappe has Possibility of Remote Code Execution due to improper validation
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
Reserved 2025-03-18 | Published 2025-03-25 | Updated 2025-03-25 | Assigner GitHub_MCWE-20: Improper Input Validation
github.com/...frappe/security/advisories/GHSA-v342-4xr9-x3q3
Support options
