CVE-2025-68953

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada frappe. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.

Rincian

Terbit di NVD

5 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/frappe/frappe/security/advisories/GHSA-xj39-3g4p-f46v advisory vendor
• https://github.com/frappe/frappe/commit/3867fb112c3f7be1a863e40f19e9235719f784fb patch
• https://github.com/frappe/frappe/commit/959efd6a498cfaeaf7d4e0ab6cca78c36192d34d patch