Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-39385Frappe LMS enrollment bypass in paid courses via unrelated batch
- CVE-2026-55242ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
- CVE-2026-55852Frappe: TarSlip RCE in Package Import
- CVE-2026-42219Frappe: Path Traversal via /backups Route
- CVE-2026-49394Frappe: Auth. bypass via update_page
- CVE-2026-48127Frappe: Arbitrary Attachment Injection via add_attachments and upload_file
- CVE-2026-41482Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator
- CVE-2026-47199Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE
- CVE-2026-58503Frappe: Unauthenticated User Enumeration via reset_password
- CVE-2026-47422Frappe: Unrestricted API access to save_report
- CVE-2026-50712Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering
- CVE-2026-50711Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering
- CVE-2026-50710Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config
- CVE-2026-50709Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering
- CVE-2026-50708Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering
- CVE-2026-50705Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering
- CVE-2026-50704Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering
- CVE-2026-50703Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering
- CVE-2026-50701Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering
- CVE-2026-50700Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering
- CVE-2026-50699Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering
- CVE-2026-50698Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering
- CVE-2026-53568Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'
- CVE-2026-50026Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints
- CVE-2026-47182Frappe: Broken Access Control on Private Files
- CVE-2026-44976Frappe: IDOR in update_onboarding_step
- CVE-2026-44975Frappe: Missing authorization on reset form tours
- CVE-2026-44206Frappe: DB Schema Enumeration via Frappe-Authorization-Source
- CVE-2026-44207Frappe: Insecure Direct Object Reference for email accounts
- CVE-2026-44208Frappe: IDOR in `submit_discussion()`