CVE-2025-66206

Katalog CVE

CVSS 8.6 · High EPSS 0,34%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada frappe. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.

Rincian

Terbit di NVD

1 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/frappe/frappe/security/advisories/GHSA-v4wg-gqfr-rpjm advisory vendor