CVE-2025-52896

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-52896
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52896.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-52896
Aliases
  • GHSA-hv29-66qg-2v6p
Published
2025-06-30T17:12:50.590Z
Modified
2026-04-10T05:30:44.944661Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe authenticated XSS via data import
Details

Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52896.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/frappe/frappe

Affected ranges

Type
GIT
Repo
https://github.com/frappe/frappe
Events
Introduced
b8c1f492c492f7cbbfd3cc768234fbb244fd3737
Fixed
b5bfe4028585ad2f7ed35557d287267ecbf83b15

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52896.json"