Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M
CVE-2026-44205Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload
Medium 6.9
In plain English
A medium-severity cross-site scripting in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 82.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/frappe/frappe/security/advisories/GHSA-2wx6-8gmq-x4fw x_refsource_CONFIRM