Technology · Frappe
Frappe Framework vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 49 vulnerabilities in Frappe Framework: 1 in the last 7 days and 31 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124443, was published on 8 November 2026. 23 vulnerabilities in the last four weeks, up 2200% on the four before (1). 1 critical against 0.
- Last 7 days
- 1
- Last 90 days
- 31
- Critical, all time
- 6
- Exploited in the wild
- 0
About Frappe Framework
Python-based web framework for building business applications and ERPs.
Latest Frappe Framework vulnerabilities
- CVE-2026-124443: Frappe Framework broken access control in File list and report queriesmediumCVSS 4.3
- CVE-2026-119145: Frappe path traversal in file uploadcriticalCVSS 9.9
- CVE-2026-119144: Frappe Framework server-side template injection in message fieldshighCVSS 8.8
- CVE-2026-114664: Frappe Framework blind SQL injection in get_events methodhighCVSS 7.1
- CVE-2026-111388: Frappe Framework restrict_ip allowlist bypass for non-session authmediumCVSS 5.4EPSS 0.2%
- CVE-2026-66057: Frappe open redirect in OAuth login flowinfoEPSS 0.4%
- CVE-2026-55823: Frappe SQL injection in reportview get_count methodinfoEPSS 0.4%
- CVE-2026-109602: Frappe stored cross-site scripting in dashboard chart filtersmediumCVSS 5.4EPSS 0.2%
- CVE-2026-109601: Frappe Framework arbitrary file read in outgoing email HTMLmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109600: Frappe Framework missing authorization in Document Follow email notificationsmediumCVSS 5.3EPSS 0.2%
- CVE-2026-109599: Frappe missing authorization in record modificationmediumCVSS 4.3EPSS 0.2%
- CVE-2026-109598: Frappe Framework missing authorization in send_sms APImediumCVSS 4.3EPSS 0.2%
- CVE-2025-71431: Frappe LDAP injection in endpoint parametersmediumCVSS 5.3EPSS 0.3%
- CVE-2025-71430: Frappe stored cross-site scripting in leaderboardmediumCVSS 5.4EPSS 0.2%
- CVE-2024-58391: Frappe cross-site scripting in printviewmediumCVSS 4.3EPSS 0.3%
- CVE-2024-58390: Frappe privilege escalation via document actionhighCVSS 8.8EPSS 0.3%
- CVE-2023-54412: Frappe improper access control in Email Template permissionsmediumCVSS 6.5EPSS 0.2%
- CVE-2023-54411: Frappe framework weak authentication in print view accessmediumCVSS 5.9EPSS 0.3%
- CVE-2023-54410: Frappe improper authorization in document renamemediumCVSS 4.3EPSS 0.2%
- CVE-2023-54409: Frappe cross-site scripting in html2textmediumCVSS 4.8EPSS 0.2%
- CVE-2023-54408: Frappe HTML injection via weak escapingmediumCVSS 6.1EPSS 0.2%
- CVE-2023-54407: Frappe information disclosure in error log tracebacksmediumCVSS 4.9EPSS 0.3%
- CVE-2023-54406: Frappe sandbox bypass in Server Script executionmediumCVSS 4.9EPSS 0.3%
- CVE-2023-51769: Frappe cross-site scripting in blog and exception pagesmediumCVSS 6.1EPSS 0.2%
- CVE-2026-81731: Frappe workspace card description XSSmediumCVSS 5.4EPSS 0.3%
Most severe Frappe Framework vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-119145: Frappe path traversal in file uploadcriticalCVSS 9.9
- CVE-2025-67289: Frappe Framework and ERPNext Arbitrary File Upload in AttachmentscriticalCVSS 9.6EPSS 0.4%
- CVE-2026-39351: Frappe unrestricted Doctype access via API exploitcriticalCVSS 9.1EPSS 0.3%
- CVE-2026-31017: Frappe ERPNext and Frappe Framework SSRF in Print Format PDF generationcriticalCVSS 9.1EPSS 0.3%
- CVE-2025-68929: Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with…criticalCVSS 9EPSS 0.5%
- CVE-2025-65267: In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers…criticalCVSS 9EPSS 0.4%
- CVE-2024-58390: Frappe privilege escalation via document actionhighCVSS 8.8EPSS 0.3%
- CVE-2026-119144: Frappe Framework server-side template injection in message fieldshighCVSS 8.8
- CVE-2025-68953: Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include…highCVSS 7.5EPSS 0.4%
- CVE-2025-66205: Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to…highCVSS 7.1EPSS 0.3%
Vulnerabilities per week
23 vulnerabilities in the last four weeks, up 2200% on the four before (1). 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 5 | 0 | |
| 24 Aug 2026 | 2 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 19 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 2 | 1 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Frappe Framework vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/frappe)<a href="https://junglewise.ai/threats/technologies/frappe"><img src="https://junglewise.ai/threats/technologies/frappe/badge.svg" alt="Frappe Framework vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/frappe.json, and this page as text at https://junglewise.ai/threats/technologies/frappe.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Frappe Framework vulnerabilities", https://junglewise.ai/threats/technologies/frappe, 13 November 2026.