CVE-2025-67289

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

Score

CVSS 3.1 9.6 Critical

Status

Modified - cve@mitre.org

Published

2025-12-22

Last modified

2026-07-05

Weaknesses

CWE-434, CWE-79

Affected products

• Erpnext (Frappe)
• Frappe (Frappe)

References

• https://github.com/vuquyen03/CVE/blob/main/CVE-2025-67289/README.md