CVE-2025-30212: Frappe has possibility of SQL injection due to improper validations

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-25 · updated 2026-06-17
Weakness: CWE-89

Description

Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.

Affected products

frappe: before 14.89.0; from 15.0.0 before 15.51.0 — fixed in 14.89.0, 15.51.0

How to fix

Upgrade to a fixed version: frappe 14.89.0, 15.51.0. Check the vendor advisory for mitigations.

References

https://github.com/frappe/frappe/commit/27f13437db161a173137d91cd07d0f9287d7c556
https://github.com/frappe/frappe/commit/2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c
https://github.com/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3

Get alerted when CVE-2025-30212 or the next vulnerability affects your stack