CVE-2025-67289 | THREATINT

Description

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

PUBLISHED Reserved 2025-12-08 | Published 2025-12-22 | Updated 2025-12-22 | Assigner mitre

References

erpnext.com

frappe.com

github.com/vuquyen03/CVE/blob/main/CVE-2025-67289/README.md

cve.org (CVE-2025-67289)

nvd.nist.gov (CVE-2025-67289)

Download JSON