Critical · published December 29, 2025
🚨 An authenticated user could unwittingly click a specially crafted link, unleashing a malicious template on the server — and just like that, it's game over! 🔥 Think of it like a restaurant where a waiter serves a customer a dish they didn't order. If the dish is tainted, the whole kitchen could end up in chaos, with everyone getting sick from that one wrong order. This vulnerability could lead to remote code execution on the server, allowing an attacker to run arbitrary code, access confidential data, or even take complete control of the web application. In the wrong hands, this could be absolutely devastating — imagine a rogue chef in the kitchen turning the whole restaurant upside down!
Think of it like a restaurant where a waiter serves a customer a dish they didn't order. If the dish is tainted, the whole kitchen could end up in chaos, with everyone getting sick from that one wrong order. CVE-2025-68929 affects Frappe versions prior to 14.99.6 and 15.88.1, allowing an authenticated user with certain permissions to be tricked into executing a malicious template on the server through a manipulated link.
This vulnerability could lead to remote code execution on the server, allowing an attacker to run arbitrary code, access confidential data, or even take complete control of the web application. In the wrong hands, this could be absolutely devastating — imagine a rogue chef in the kitchen turning the whole restaurant upside down! Upgrade immediately to Frappe versions 14.99.6 or 15.88.1 to patch this critical vulnerability. Since no workarounds are available, promptly addressing this issue is essential for maintaining server integrity and security. Don't wait — secure your environment now! You've got this! Follow these steps and you'll have your system protected in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| frappe/frappe | < 14.99.6 | 14.99.6 |
| frappe/frappe | ≥ 15.0.0, < 15.88.1 | 15.88.1 |