# frappe.

Every CVE that names frappe among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload](https://agentprime.io/advisories/CVE-2026-119145.md)
  `CVE-2026-119145` · CVE record: frappe frappe · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields](https://agentprime.io/advisories/CVE-2026-119144.md)
  `CVE-2026-119144` · CVE record: frappe frappe · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [Frappe before 16.33.0 Blind SQL Injection via get_events](https://agentprime.io/advisories/CVE-2026-114664.md)
  `CVE-2026-114664` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication](https://agentprime.io/advisories/CVE-2026-111388.md)
  `CVE-2026-111388` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Frappe: Possibility of SQL injection in reportview](https://agentprime.io/advisories/CVE-2026-55823.md)
  `CVE-2026-55823` · CVE record: frappe frappe · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection
- [Frappe: Open Redirect via Unsanitized OAuth State Param.](https://agentprime.io/advisories/CVE-2026-66057.md)
  `CVE-2026-66057` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Open redirect
- [Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit](https://agentprime.io/advisories/CVE-2026-109603.md)
  `CVE-2026-109603` · CVE record: frappe frappe · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters](https://agentprime.io/advisories/CVE-2026-109602.md)
  `CVE-2026-109602` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML](https://agentprime.io/advisories/CVE-2026-109601.md)
  `CVE-2026-109601` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Path traversal
- [Frappe before 16.31.0 Improper Access Control in Document Follow Notifications](https://agentprime.io/advisories/CVE-2026-109600.md)
  `CVE-2026-109600` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification](https://agentprime.io/advisories/CVE-2026-109599.md)
  `CVE-2026-109599` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 16.33.0 Broken Authorization via send_sms Endpoint](https://agentprime.io/advisories/CVE-2026-109598.md)
  `CVE-2026-109598` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters](https://agentprime.io/advisories/CVE-2025-71431.md)
  `CVE-2025-71431` · CVE record: frappe frappe · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Other injection
- [Frappe before 15.91.1 Stored XSS via Leaderboard User Names](https://agentprime.io/advisories/CVE-2025-71430.md)
  `CVE-2025-71430` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before 15.4.0 XSS via Printview Parameters](https://agentprime.io/advisories/CVE-2024-58391.md)
  `CVE-2024-58391` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before 15.41.0 Privilege Escalation via Document Action](https://agentprime.io/advisories/CVE-2024-58390.md)
  `CVE-2024-58390` · CVE record: frappe frappe · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation
- [Frappe before 13.46.3 Improper Access Control for Email Templates](https://agentprime.io/advisories/CVE-2023-54412.md)
  `CVE-2023-54412` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 13.32.0 Weak Authentication via Print View Key](https://agentprime.io/advisories/CVE-2023-54411.md)
  `CVE-2023-54411` · CVE record: frappe frappe · CVSS 8.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Frappe before 13.22.0 Improper Authorization via Document Rename](https://agentprime.io/advisories/CVE-2023-54410.md)
  `CVE-2023-54410` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 13.46.1 XSS via html2text Weak Sanitization](https://agentprime.io/advisories/CVE-2023-54409.md)
  `CVE-2023-54409` · CVE record: frappe frappe · CVSS 5.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before 14.31.0 HTML Injection via Weak Escaping](https://agentprime.io/advisories/CVE-2023-54408.md)
  `CVE-2023-54408` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks](https://agentprime.io/advisories/CVE-2023-54407.md)
  `CVE-2023-54407` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure
- [Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts](https://agentprime.io/advisories/CVE-2023-54406.md)
  `CVE-2023-54406` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-372
- [Cross-site scripting in Frappe](https://agentprime.io/advisories/CVE-2023-51769.md)
  `CVE-2023-51769` · CVE record: Frappe Frappe · CVSS 6.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint](https://agentprime.io/advisories/CVE-2026-82634.md)
  `CVE-2026-82634` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 30 Aug 2026 · Tags: Broken access control
- [Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description](https://agentprime.io/advisories/CVE-2026-81731.md)
  `CVE-2026-81731` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Frappe: Access control bypass via REST API dot-notation fields on linked doctypes](https://agentprime.io/advisories/CVE-2026-66003.md)
  `CVE-2026-66003` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Frappe: User Enumeration via PDDR](https://agentprime.io/advisories/CVE-2026-66002.md)
  `CVE-2026-66002` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-204
- [Frappe: Improper Authorization in OAuth2 Consent Endpoint](https://agentprime.io/advisories/CVE-2026-66001.md)
  `CVE-2026-66001` · CVE record: frappe frappe · CVSS 8.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Frappe: Mass assignment via set_value](https://agentprime.io/advisories/CVE-2026-62315.md)
  `CVE-2026-62315` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control
- [Frappe: Unauthenticated Workflow approval via confirm_action](https://agentprime.io/advisories/CVE-2026-63654.md)
  `CVE-2026-63654` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Frappe: Missing authorization in toggle_like and mark_as_seen](https://agentprime.io/advisories/CVE-2026-53569.md)
  `CVE-2026-53569` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control
- [Frappe: Unrestricted access to Document Follow APIs](https://agentprime.io/advisories/CVE-2026-66000.md)
  `CVE-2026-66000` · CVE record: frappe frappe · CVSS 2.3 Low · Not analysed yet · Published 7 Aug 2026 · Tags: Broken access control
- [Frappe has potential SQL Injection due to missing validation](https://agentprime.io/advisories/CVE-2025-58375.md)
  `CVE-2025-58375` · CVE record: frappe frappe · CVSS 8.1 High · Not analysed yet · Published 7 Aug 2026 · Tags: SQL injection
- [Frappe: Unrestricted access to a Document Follow API](https://agentprime.io/advisories/CVE-2026-66058.md)
  `CVE-2026-66058` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Broken access control
- [Frappe: Field-level permission bypass via Document Follow](https://agentprime.io/advisories/CVE-2026-66059.md)
  `CVE-2026-66059` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Broken access control
- [Frappe: Stored XSS in Column Headers via Data Import](https://agentprime.io/advisories/CVE-2026-49391.md)
  `CVE-2026-49391` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Frappe: Lack of Permissions in restore/bulk_restore](https://agentprime.io/advisories/CVE-2026-47765.md)
  `CVE-2026-47765` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 6 Aug 2026 · Tags: Broken access control
- [Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain](https://agentprime.io/advisories/CVE-2026-47194.md)
  `CVE-2026-47194` · CVE record: frappe frappe · CVSS 8.6 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-346
- [Frappe Has Broken Access Control in its Workspace Save API](https://agentprime.io/advisories/CVE-2026-47185.md)
  `CVE-2026-47185` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site scripting (XSS), Broken access control
- [Frappe: TarSlip RCE in Package Import](https://agentprime.io/advisories/CVE-2026-55852.md)
  `CVE-2026-55852` · CVE record: frappe frappe · CVSS 8.6 High · Not analysed yet · Published 10 Jul 2026 · Tags: Path traversal
- [Frappe: Path Traversal via /backups Route](https://agentprime.io/advisories/CVE-2026-42219.md)
  `CVE-2026-42219` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Path traversal
- [Frappe: Auth. bypass via update_page](https://agentprime.io/advisories/CVE-2026-49394.md)
  `CVE-2026-49394` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 10 Jul 2026 · Tags: Broken access control
- [Frappe: Arbitrary Attachment Injection via add_attachments and upload_file](https://agentprime.io/advisories/CVE-2026-48127.md)
  `CVE-2026-48127` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Broken access control
- [Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator](https://agentprime.io/advisories/CVE-2026-41482.md)
  `CVE-2026-41482` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 10 Jul 2026 · Tags: Path traversal
- [Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE](https://agentprime.io/advisories/CVE-2026-47199.md)
  `CVE-2026-47199` · CVE record: frappe frappe · CVSS 2.3 Low · Not analysed yet · Published 10 Jul 2026 · Tags: SQL injection
- [Frappe: Unauthenticated User Enumeration via reset_password](https://agentprime.io/advisories/CVE-2026-58503.md)
  `CVE-2026-58503` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Information disclosure
- [Frappe: Unrestricted API access to save_report](https://agentprime.io/advisories/CVE-2026-47422.md)
  `CVE-2026-47422` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Broken access control
- [Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'](https://agentprime.io/advisories/CVE-2026-53568.md)
  `CVE-2026-53568` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints](https://agentprime.io/advisories/CVE-2026-50026.md)
  `CVE-2026-50026` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control
- [Frappe: Broken Access Control on Private Files](https://agentprime.io/advisories/CVE-2026-47182.md)
  `CVE-2026-47182` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control
- [Frappe: IDOR in update_onboarding_step](https://agentprime.io/advisories/CVE-2026-44976.md)
  `CVE-2026-44976` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control
- [Frappe: Missing authorization on reset form tours](https://agentprime.io/advisories/CVE-2026-44975.md)
  `CVE-2026-44975` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control
- [Frappe: DB Schema Enumeration via Frappe-Authorization-Source](https://agentprime.io/advisories/CVE-2026-44206.md)
  `CVE-2026-44206` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Information disclosure
- [Frappe: Insecure Direct Object Reference for email accounts](https://agentprime.io/advisories/CVE-2026-44207.md)
  `CVE-2026-44207` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control
- [Frappe: IDOR in \`submit_discussion()\`](https://agentprime.io/advisories/CVE-2026-44208.md)
  `CVE-2026-44208` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control
- [Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload](https://agentprime.io/advisories/CVE-2026-44205.md)
  `CVE-2026-44205` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Frappe Vulnerable to Possible SQL Injection via get_blog_list](https://agentprime.io/advisories/CVE-2026-41581.md)
  `CVE-2026-41581` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: SQL injection
- [Frappe: Stored XSS in Note](https://agentprime.io/advisories/CVE-2026-47739.md)
  `CVE-2026-47739` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Frappe has an Arbitrary File Read via Path Traversal in render_include](https://agentprime.io/advisories/CVE-2026-39352.md)
  `CVE-2026-39352` · CVE record: frappe frappe · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: Path traversal

Older: <https://agentprime.io/advisories/technology/frappe.md?cursor=WyIyMDI2LTA1LTIwVDE5OjI3OjAxLjU0MzAwMFoiLCJDVkUtMjAyNi0zOTM1MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=frappe>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/frappe/>. Everything for agents: <https://agentprime.io/llms.txt>.