CVE-2025-67289

9.6

CRITICALCVSS v3

Published

December 22, 2025

Affected

7 projects

Assigned by

MITRE

Severity scale

010

Description

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

frappe/frappe

GitHubLow code web framework for real world applications, in Python and Javascript

= 15.89.0NVD

frappe/erpnext

GitHubFree and Open Source Enterprise Resource Planning (ERP)

= 15.89.0NVD

Frappe

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

The core implementation library for Frappe. Frappe is a compile time bundler for JavaScript, Css, and Less for high volume, high performance ASP.NET sites.

= 15.89.0NVD