Vulnerability · Published Dec 1, 2025 · Assigned by GitHub_M

CVE-2025-66206Frappe vulnerable to a path traversal allowing reading certain files

Medium 6.8

In plain English

A medium-severity path traversal in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 69.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	>= 15.0.0, < 15.86.0< 14.99.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/frappe/frappe/security/advisories/GHSA-v4wg-gqfr-rpjm x_refsource_CONFIRM