GHSA-v342-4xr9-x3q3Medium

Frappe has Possibility of Remote Code Execution due to improper validation

Published
March 25, 2025
Last Modified
March 30, 2025

🔗 CVE IDs covered (1)

CVE-2025-30213 →

📋 Description

Impact

A system user was able to create certain documents in a specific way that could lead to RCE.

Workarounds

There's no workaround, an upgrade is required.

Credits

Thanks to Thanh of Calif.io for reporting the issue

🎯 Affected products2

  • pip/frappe:< 14.91.0
  • pip/frappe:>= 15.0.0, < 15.52.0

🔗 References (3)