CVE-2025-30213

HIGH

Frappe < 14.91.0 - Remote Code Execution via Document Creation

Title source: llm
STIX 2.1

Description

Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0083
EPSS Percentile 74.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-20
Status published
Products (2)
frappe/frappe < 14.91.0
pypi/frappe 0 - 14.91.0PyPI
Published Mar 25, 2025
Tracked Since Feb 18, 2026