CVE-2025-68929

CRITICAL

9.0

Descripcion

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

Detalles CVE

Puntuacion CVSS v3.19.0

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado12/29/2025

Ultima modificacion12/31/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

frappe:frappe

Debilidades (CWE)

CWE-1336

Referencias

https://github.com/frappe/frappe/releases/tag/v14.99.6(security-advisories@github.com)

https://github.com/frappe/frappe/releases/tag/v15.88.1(security-advisories@github.com)

https://github.com/frappe/frappe/security/advisories/GHSA-qq98-vfv9-xmxh(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.