CVE-2022-41712

6.5 mediumEPSS 1.0%

Medium (6.5) in frappe frappe. EPSS 1.0% chance of exploitation in the next 30 days.

Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2022-11-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

frappe:frappe

References

https://fluidattacks.com/advisories/kiniza/
https://github.com/frappe/frappe/
https://fluidattacks.com/advisories/kiniza/
https://github.com/frappe/frappe/

Check your stack JSON