CVE-2025-68929: Frappe may be vulnerable remote code execution due to server-side template injection
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68929?
The severity of CVE-2025-68929 is considered high due to the potential for remote code execution by authenticated users.
How do I fix CVE-2025-68929?
To fix CVE-2025-68929, upgrade Frappe to versions 14.99.6 or 15.88.1 or later.
What versions of Frappe are affected by CVE-2025-68929?
CVE-2025-68929 affects Frappe versions prior to 14.99.6 and 15.88.1.
Can CVE-2025-68929 be exploited remotely?
CVE-2025-68929 cannot be exploited remotely without authentication, as it requires specific user permissions.
What types of attacks can result from CVE-2025-68929?
CVE-2025-68929 can lead to the execution of a malicious template on the server, resulting in remote code execution.