CVE-2025-71431: Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 14.99.2 are affected, as are 15.x versions before 15.86.0. The issue applies where vulnerable endpoints use user-supplied parameters in LDAP queries.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network exploitation with low attack complexity and no privileges or user interaction required.
What can an attacker achieve through this issue?
An attacker can provide crafted LDAP filter syntax that changes the directory query performed by affected endpoints. The stated impact is limited to confidentiality, with no integrity or availability impact indicated.