CVE-2025-30213 Frappe has Possibility of Remote Code Execution due to improper validation

Medium 6.3 Published 25 Mar 2025 Updated 25 Mar 2025

A system user can achieve remote code execution in the Frappe framework by creating specific documents, requiring an upgrade to fix.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-30213?

CVE-2025-30213 is a medium-severity code injection vulnerability in frappe, published on 25 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.

Weakness: CWE-20

Which versions are affected by CVE-2025-30213?

5 open source packages ship an affected version, including frappe. It affects 1 product.

Package	Affected	Fixed in
`frappe` PyPI	All versions	`14.91.0, 15.52.0`
`frappe` PyPI	All versions	`14.91.0`
`frappe` PyPI	All versions	`14.91.0`
`frappe` PyPI	From `15.0.0`	`15.52.0`
`frappe` PyPI	From `15.0.0`	`15.52.0`

Products include Frappe Frappe.

How do I fix CVE-2025-30213?

Upgrade frappe to a fixed version for your release line: 14.91.0 or 15.52.0.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-30213 being exploited?

There is no known exploitation of CVE-2025-30213 in the wild and no public exploit code.

Sources

Also known as GHSA-v342-4xr9-x3q3, PYSEC-2026-1393.