CVE-2025-68953 - CVE House
Back to Database
Status published High CVE-2025-68953

Certain Frappe requests are vulnerable to Path Traversal

Vulnerability Description

Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68953

Credits & Attribution

No credits recorded in the NVD database.

References

More from frappe

View All →
CVE-2025-68929
Frappe may be vulnerable remote code execution due to server-side template injection
Critical 9.1
CVE-2025-68928
Frappe CRM vulnerable to authenticated XSS via website field
Medium 5.4
CVE-2025-67734
Frappe Authenticated Users can Execute JavaScript through its Job Form
Medium 5.1
CVE-2025-67730
Frappe authenticated users can execute XSS through form description fields
Medium 5.1
CVE-2025-66581
Frappe LMS is Missing Server-Side Authorization in Business Logic
Low 1.3

Affected Vendor

Affected Software

frappe
Vulnerable Versions:
< 14.99.6, >= 15.0.0, < 15.88.1

Timeline

Official Publish: January 5th, 2026
Last Modified: January 6th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact