UpHeron
All vulnerabilities

Servers and applications

CVE-2025-52896

Authenticated XSS via data import

Severity
High 8.6
Published
30 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.94.2, 15.57.0
Also known as
GHSA-hv29-66qg-2v6p
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.94.2
  • From 15.0.0 before 15.57.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 15.57.0
  • Every version before 14.94.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-52896
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52896
  • GitHub Advisory Database https://github.com/advisories/GHSA-hv29-66qg-2v6p
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-hv29-66qg-2v6p