Vulnerability · Published Jun 30, 2025 · Assigned by GitHub_M

CVE-2025-52896Frappe authenticated XSS via data import

High 8.6

In plain English

A high-severity cross-site scripting in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	< 15.57.0< 14.94.2

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/frappe/frappe/security/advisories/GHSA-hv29-66qg-2v6p x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/31483 x_refsource_MISC
https://github.com/frappe/frappe/commit/152fd09de5bca16b8d299d715a1f5df6fca3866f x_refsource_MISC
https://github.com/frappe/frappe/commit/f11c53d4df745b58bd1c1c08e1634a2f5a55322a x_refsource_MISC