Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server…

High CVSS 7.5

CVECVE-2025-68953

First seen2026-10-14 16:30 UTC

Disclosed2026-01-05 22:15 UTC

Last updated2026-10-14 16:30 UTC

Channel statusauto

Summary

Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://github.com/frappe/frappe/commit/3867fb112c3f7be1a863e40f19e9235719f784fb Patch
https://github.com/frappe/frappe/commit/959efd6a498cfaeaf7d4e0ab6cca78c36192d34d Patch
https://github.com/frappe/frappe/security/advisories/GHSA-xj39-3g4p-f46v Vendor Advisory

Timeline

2026-10-14 nvd_ingest NVD