CVE-2025-68953

Published: Jan 5, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.

Affected (2)

Products: Frappe: Frappe

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Frappe Frappe	Before 14.99.6
Frappe Frappe	From 15.0.0 to 15.88.1

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://github.com/frappe/frappe/commit/3867fb112c3f7be1a863e40f19e9235719f784fb

Source: security-advisories@github.com

Patch

https://github.com/frappe/frappe/commit/959efd6a498cfaeaf7d4e0ab6cca78c36192d34d

Source: security-advisories@github.com

Patch

https://github.com/frappe/frappe/security/advisories/GHSA-xj39-3g4p-f46v

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.