Frappe vulnerable to information disclosure leading to account takeover

高危 7.5CVE-2025-30214 · GHSA-qrv3-jc3h-f3m6 · PYSEC-2026-1392 · Published 25/03/2025 · updated 17/06/2026

要点

CVE-2025-30214 是影响 frappe, frappe (frappe) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.41%，高于 35.8% 的漏洞。
修复：升级到 15.51.0, 14.89.0 或更高版本。

Package	Affected versions	Patched versions
frappe PyPI	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`
frappe frappe	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`

Description

Impact

Making crafted requests could lead to information disclosure that could further lead to account takeover.

Workarounds

There's no workaround to fix this without upgrading.

Credits

Thanks to Thanh of Calif.io for reporting the issue

NVD description

Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.

References

frappe/frappe security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-30214 · ADVISORY
frappe/frappe · PACKAGE
pypi.org/project/frappe · PACKAGE
GitHub Advisory GHSA-qrv3-jc3h-f3m6 · ADVISORY

frappe 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

frappe

PyPI

≥ 15.0.0, < 15.51.0< 14.89.0

15.51.014.89.0

frappe

≥ 15.0.0, < 15.51.0< 14.89.0

15.51.014.89.0

Description

Impact

Making crafted requests could lead to information disclosure that could further lead to account takeover.

Workarounds

There's no workaround to fix this without upgrading.

Credits

Thanks to Thanh of Calif.io for reporting the issue

NVD description

frappe 的其他漏洞

查看全部 →