What’s Vulnerable › Vulnerabilities

CVE-2025-68929: Frappe may be vulnerable remote code execution due to server-side template injection

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-29 · updated 2026-10-13
• Weakness: CWE-1336

Description

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

Affected products

• frappe: before 14.99.6; from 15.0.0 before 15.88.1 — fixed in 14.99.6, 15.88.1

How to fix

Upgrade to a fixed version: frappe 14.99.6, 15.88.1. Check the vendor advisory for mitigations.

References

• https://github.com/frappe/frappe/releases/tag/v14.99.6
• https://github.com/frappe/frappe/releases/tag/v15.88.1
• https://github.com/frappe/frappe/security/advisories/GHSA-qq98-vfv9-xmxh

Get alerted when CVE-2025-68929 or the next vulnerability affects your stack