High severity · published Jun 30, 2025
CVE-2025-52898
Frappe is a full-stack web application framework
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Frappe · Frappe
before 14.94.3; 15.0.0 before 15.58.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52898
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52898
Patch
https://github.com/frappe/frappe/commit/52e31337a6c964189c8b883a2f7bc3a28ab374f2
Patch
https://github.com/frappe/frappe/commit/5b4849b1ab5fd796b306312745b4e202b0e90d66
Issue Tracking
https://github.com/frappe/frappe/pull/31522
Vendor Advisory
https://github.com/frappe/frappe/security/advisories/GHSA-p284-r7rh-wq7j
More from Frappe
9.8
CVE-2026-35614
Frappe has a SQL injection in bulk_update
9.8
CVE-2026-31877
Frappe is a full-stack web application framework
9.8
CVE-2025-66205
Frappe is a full-stack web application framework
9.8
CVE-2019-14965
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4
9.6
CVE-2025-67289
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file