CVE-2025-52896
30.06.2025, 17:15
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
| Vendor | Product | Version |
|---|---|---|
| frappe | frappe | 𝑥 < 14.94.2 |
| frappe | frappe | 15.0.0 ≤ 𝑥 < 15.57.0 |
𝑥
= Vulnerable software versions