요약
- CVE-2025-30213은(는) frappe, frappe (frappe)에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.72%, 전체 취약점의 54.0%보다 높음.
- 조치: 15.52.0, 14.91.0 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| frappe PyPI | ≥ 15.0.0, < 15.52.0< 14.91.0
| 15.52.014.91.0
|
| frappe | ≥ 15.0.0, < 15.52.0< 14.91.0
| 15.52.014.91.0
|
Description
Impact
A system user was able to create certain documents in a specific way that could lead to RCE.
Workarounds
There's no workaround, an upgrade is required.
Credits
Thanks to Thanh of Calif.io for reporting the issue
NVD description
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free