CVE-2025-66206

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/frappe/frappe/security/advisories/GHSA-v4wg-gqfr-rpjm	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:frappe:frappe::::::::
	cpe:2.3:a:frappe:frappe::::::::

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Frappe es un framework de aplicación web full-stack. Versiones anteriores a la 15.86.0 y 14.99.2, ciertas solicitudes eran vulnerables a ataques de salto de ruta, mediante los cuales algunos archivos del servidor podían ser recuperados si se conocía la ruta completa. Los sitios alojados en Frappe Cloud, e incluso otras configuraciones que están detrás de un proxy inverso como NGINX, no se ven afectados. Esto afectaría principalmente a quienes utilizan directamente werkzeug/gunicorn. En esos casos, se recomienda una actualización o cambiar la configuración para usar un proxy inverso. Esta vulnerabilidad está corregida en las versiones 15.86.0 y 14.99.2.

Information

Published : 2025-12-01 21:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-66206

Mitre link : CVE-2025-66206

CVE.ORG link : CVE-2025-66206

JSON object : View

Products Affected

frappe

frappe

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-66206", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66206", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T20:36:49.667141Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frappe", "product": "frappe", "versions": [{"status": "affected", "version": ">= 15.0.0, < 15.86.0"}, {"status": "affected", "version": "< 14.99.2"}]}]}], "published": "2025-12-01T21:15:52.623", "references": [{"url": "https://github.com/frappe/frappe/security/advisories/GHSA-v4wg-gqfr-rpjm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2."}, {"lang": "es", "value": "Frappe es un framework de aplicaci\u00f3n web full-stack. Versiones anteriores a la 15.86.0 y 14.99.2, ciertas solicitudes eran vulnerables a ataques de salto de ruta, mediante los cuales algunos archivos del servidor pod\u00edan ser recuperados si se conoc\u00eda la ruta completa. Los sitios alojados en Frappe Cloud, e incluso otras configuraciones que est\u00e1n detr\u00e1s de un proxy inverso como NGINX, no se ven afectados. Esto afectar\u00eda principalmente a quienes utilizan directamente werkzeug/gunicorn. En esos casos, se recomienda una actualizaci\u00f3n o cambiar la configuraci\u00f3n para usar un proxy inverso. Esta vulnerabilidad est\u00e1 corregida en las versiones 15.86.0 y 14.99.2."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F7C6678-1529-4C46-BF75-8647AF1170C9", "versionEndExcluding": "14.99.2"}, {"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63006503-DD78-47D9-ACDE-9D3480FAE9F6", "versionEndExcluding": "15.86.0", "versionStartIncluding": "15.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}