UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66206

Path traversal allowed reading certain files

Severity
High 8.6
Published
1 Dec 2025
Last changed
19 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.99.2, 15.86.0
Also known as
GHSA-v4wg-gqfr-rpjm
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using…

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.99.2
  • From 15.0.0 before 15.86.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 15.86.0
  • Every version before 14.99.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66206
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66206
  • GitHub Advisory Database https://github.com/advisories/GHSA-v4wg-gqfr-rpjm
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-v4wg-gqfr-rpjm