CVE-2025-68929

—

CVSS 3.1

9.0 critical

EPSS

<1%p41

Published

Dec 29, 2025 (Dec 29, 2025)

Modified

Jun 17, 2026

Description

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

Vendors: frappe
Products: frappe
Weakness: CWE-1336
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.