Vulnerability · Published Mar 25, 2025 · Assigned by GitHub_M
CVE-2025-30213Frappe has Possibility of Remote Code Execution due to improper validation
Medium 6.3
In plain English
A medium-severity improper input validation in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | frappe | 14.91.0 | GHSA-v342-4xr9-x3q3 |
| PyPI | frappe | 15.52.0 | GHSA-v342-4xr9-x3q3 |
| PyPI | frappe | 14.91.0, 15.52.0 | PYSEC-2026-1393 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
References
- https://github.com/frappe/frappe/security/advisories/GHSA-v342-4xr9-x3q3 x_refsource_CONFIRM