CVE-2025-68953 Certain Frappe requests are vulnerable to Path Traversal
Attackers can retrieve arbitrary files from the server due to insufficient input sanitization in Frappe web framework requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-68953?
CVE-2025-68953 is a high-severity path traversal vulnerability in frappe, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.
Weakness: CWE-22
Which versions are affected by CVE-2025-68953?
It affects 1 product.
Products include Frappe Frappe.
How do I fix CVE-2025-68953?
No fix has been published for CVE-2025-68953 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-68953 being exploited?
There is no known exploitation of CVE-2025-68953 in the wild and no public exploit code.
Other vulnerabilities in frappe
- CVE-2019-14965 Code injection in n/a
- CVE-2026-35614 Frappe has a SQL injection in bulk_update
- CVE-2026-31877 Frappe SQL Injection due to improper field sanitization
- CVE-2025-68929 Frappe may be vulnerable remote code execution due to server-side template injection
- CVE-2019-14966 SQL injection in n/a
Sources
Also known as GHSA-xj39-3g4p-f46v.