CVE-2025-68929

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

CVSS 3.1

9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-25)

CWE

CWE-1336

Published

2025-12-29

Modified

2026-10-13

Record from

the NVD, synced 2026-10-19

Affected

• frappe:frappe

References

• https://github.com/frappe/frappe/releases/tag/v14.99.6
• https://github.com/frappe/frappe/releases/tag/v15.88.1
• https://github.com/frappe/frappe/security/advisories/GHSA-qq98-vfv9-xmxh

Check your stackJSON