CVE-2025-52896CWE-79

Frappe authenticated XSS via data import

High · published June 30, 2025

CVSS v4.0
8.6
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00283 · 19.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-30T17:12Z
EPSS history
Timeline
  • 30 JUN 17:12Z
    Frappe authenticated XSS via data import
    cvelistv5