CVE-2025-66206: Frappe vulnerable to a path traversal allowing reading certain files
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.86.0 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 14.99.2 - Compensating control
Change the setup to place Frappe behind a reverse proxy such as NGINX, rather than using werkzeug/gunicorn directly.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66206?
CVE-2025-66206 has been assigned a high severity level due to the potential for path traversal attacks.
How do I fix CVE-2025-66206?
To fix CVE-2025-66206, upgrade to Frappe Framework version 15.86.0 or 14.99.2 or later.
What systems are affected by CVE-2025-66206?
CVE-2025-66206 affects Frappe Framework versions prior to 15.86.0 and 14.99.2.
Can CVE-2025-66206 lead to data exposure?
Yes, CVE-2025-66206 can allow attackers to retrieve sensitive files from the server if they know the full path.
Is CVE-2025-66206 specific to Frappe Cloud deployments?
While CVE-2025-66206 impacts Frappe Cloud, it also affects other installations of the Frappe Framework.