# Frappe Framework vulnerabilities Source: https://junglewise.ai/threats/technologies/frappe Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/frappe.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 49 vulnerabilities in Frappe Framework: 1 in the last 7 days and 31 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124443, was published on 8 November 2026. 23 vulnerabilities in the last four weeks, up 2200% on the four before (1). 1 critical against 0. ## Counts - Last 7 days: 1 - Last 30 days: 5 - Last 90 days: 31 - All time: 49 (6 critical, 0 exploited in the wild) ## About Frappe Framework Python-based web framework for building business applications and ERPs. ## Latest Frappe Framework vulnerabilities - [CVE-2026-124443: Frappe Framework broken access control in File list and report queries](https://junglewise.ai/threats/cve-2026-124443-frappe-framework-before-15-121-1-and-16-x-before-16-35-0) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-119145: Frappe path traversal in file upload](https://junglewise.ai/threats/cve-2026-119145-frappe-before-15-121-0-and-16-x-before-16-34-0-contains-a-path) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-119144: Frappe Framework server-side template injection in message fields](https://junglewise.ai/threats/cve-2026-119144-frappe-framework-before-15-111-0-and-16-x-before-16-21-0) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-114664: Frappe Framework blind SQL injection in get_events method](https://junglewise.ai/threats/cve-2026-114664-frappe-framework-before-16-33-0-contains-a-blind-sql-injection) (high, CVSS 7.1, published 22 Oct 2026) - [CVE-2026-111388: Frappe Framework restrict_ip allowlist bypass for non-session auth](https://junglewise.ai/threats/cve-2026-111388-frappe-framework-before-15-120-0-and-16-x-before-16-33-0-does) (medium, CVSS 5.4, published 16 Oct 2026) - [CVE-2026-66057: Frappe open redirect in OAuth login flow](https://junglewise.ai/threats/cve-2026-66057-frappe-is-a-full-stack-web-application-framework-prior-to-15-116) (info, published 13 Oct 2026) - [CVE-2026-55823: Frappe SQL injection in reportview get_count method](https://junglewise.ai/threats/cve-2026-55823-frappe-is-a-full-stack-web-application-framework-prior-to-16-23-0) (info, published 13 Oct 2026) - [CVE-2026-109602: Frappe stored cross-site scripting in dashboard chart filters](https://junglewise.ai/threats/cve-2026-109602-frappe-before-15-118-0-and-16-x-before-16-31-0-contains-a-stored) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-109601: Frappe Framework arbitrary file read in outgoing email HTML](https://junglewise.ai/threats/cve-2026-109601-frappe-framework-before-15-117-0-and-16-x-before-16-30-0) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109600: Frappe Framework missing authorization in Document Follow email notifications](https://junglewise.ai/threats/cve-2026-109600-frappe-framework-before-15-118-0-and-16-x-before-16-31-0-does) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109599: Frappe missing authorization in record modification](https://junglewise.ai/threats/cve-2026-109599-frappe-before-15-113-3-and-16-x-before-16-25-0-contains-a) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109598: Frappe Framework missing authorization in send_sms API](https://junglewise.ai/threats/cve-2026-109598-frappe-framework-before-15-120-0-and-16-x-before-16-33-0) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2025-71431: Frappe LDAP injection in endpoint parameters](https://junglewise.ai/threats/cve-2025-71431-frappe-before-14-99-2-and-15-x-before-15-86-0-contains-an-ldap) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2025-71430: Frappe stored cross-site scripting in leaderboard](https://junglewise.ai/threats/cve-2025-71430-frappe-before-14-99-10-and-15-x-before-15-91-1-contains-a-stored) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2024-58391: Frappe cross-site scripting in printview](https://junglewise.ai/threats/cve-2024-58391-frappe-before-14-58-0-and-15-x-before-15-4-0-contains-a-cross) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2024-58390: Frappe privilege escalation via document action](https://junglewise.ai/threats/cve-2024-58390-frappe-before-14-81-4-and-15-x-before-15-41-0-contains-an) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2023-54412: Frappe improper access control in Email Template permissions](https://junglewise.ai/threats/cve-2023-54412-frappe-before-13-46-3-and-14-x-before-14-21-1-contains-an) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2023-54411: Frappe framework weak authentication in print view access](https://junglewise.ai/threats/cve-2023-54411-frappe-framework-before-13-32-0-uses-weak-authentication-for) (medium, CVSS 5.9, published 12 Oct 2026) - [CVE-2023-54410: Frappe improper authorization in document rename](https://junglewise.ai/threats/cve-2023-54410-frappe-before-13-22-0-contains-an-improper-authorization) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2023-54409: Frappe cross-site scripting in html2text](https://junglewise.ai/threats/cve-2023-54409-frappe-before-13-46-1-and-14-x-before-14-20-0-contains-a-cross) (medium, CVSS 4.8, published 12 Oct 2026) - [CVE-2023-54408: Frappe HTML injection via weak escaping](https://junglewise.ai/threats/cve-2023-54408-frappe-before-13-52-0-and-14-x-before-14-31-0-contains-an-html) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2023-54407: Frappe information disclosure in error log tracebacks](https://junglewise.ai/threats/cve-2023-54407-frappe-14-x-before-14-45-0-contains-an-information-disclosure) (medium, CVSS 4.9, published 12 Oct 2026) - [CVE-2023-54406: Frappe sandbox bypass in Server Script execution](https://junglewise.ai/threats/cve-2023-54406-frappe-before-14-59-0-and-15-x-before-15-5-0-contains-a-sandbox) (medium, CVSS 4.9, published 12 Oct 2026) - [CVE-2023-51769: Frappe cross-site scripting in blog and exception pages](https://junglewise.ai/threats/cve-2023-51769-frappe-cross-site-scripting-in-blog-and-exception-pages) (medium, CVSS 6.1, published 14 Sep 2026) - [CVE-2026-81731: Frappe workspace card description XSS](https://junglewise.ai/threats/cve-2026-81731-frappe-workspace-card-description-xss) (medium, CVSS 5.4, published 27 Aug 2026) ## Most severe Frappe Framework vulnerabilities - [CVE-2026-119145: Frappe path traversal in file upload](https://junglewise.ai/threats/cve-2026-119145-frappe-before-15-121-0-and-16-x-before-16-34-0-contains-a-path) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2025-67289: Frappe Framework and ERPNext Arbitrary File Upload in Attachments](https://junglewise.ai/threats/cve-2025-67289-frappe-framework-and-erpnext-arbitrary-file-upload-in-attachments) (critical, CVSS 9.6, published 22 Dec 2025) - [CVE-2026-39351: Frappe unrestricted Doctype access via API exploit](https://junglewise.ai/threats/cve-2026-39351-frappe-unrestricted-doctype-access-via-api-exploit) (critical, CVSS 9.1, published 7 Apr 2026) - [CVE-2026-31017: Frappe ERPNext and Frappe Framework SSRF in Print Format PDF generation](https://junglewise.ai/threats/cve-2026-31017-frappe-erpnext-and-frappe-framework-ssrf-in-print-format-pdf) (critical, CVSS 9.1, published 8 Apr 2026) - [CVE-2025-68929: Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with…](https://junglewise.ai/threats/cve-2025-68929-frappe-is-a-full-stack-web-application-framework-prior-to) (critical, CVSS 9, published 29 Dec 2025) - [CVE-2025-65267: In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers…](https://junglewise.ai/threats/cve-2025-65267-in-erpnext-v15-83-2-and-frappe-framework-v15-86-0-improper) (critical, CVSS 9, published 3 Dec 2025) - [CVE-2024-58390: Frappe privilege escalation via document action](https://junglewise.ai/threats/cve-2024-58390-frappe-before-14-81-4-and-15-x-before-15-41-0-contains-an) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-119144: Frappe Framework server-side template injection in message fields](https://junglewise.ai/threats/cve-2026-119144-frappe-framework-before-15-111-0-and-16-x-before-16-21-0) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2025-68953: Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include…](https://junglewise.ai/threats/cve-2025-68953-frappe-is-a-full-stack-web-application-framework-versions-14-99-5) (high, CVSS 7.5, published 5 Jan 2026) - [CVE-2025-66205: Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to…](https://junglewise.ai/threats/cve-2025-66205-frappe-is-a-full-stack-web-application-framework-prior-to-15-86-0) (high, CVSS 7.1, published 1 Dec 2025) ## Vulnerabilities per week 23 vulnerabilities in the last four weeks, up 2200% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 5 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 19 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 2 | 1 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Frappe technologies - [Frappe ERPNext](https://junglewise.ai/threats/technologies/erpnext): 100 vulnerabilities - [Frappe Learning](https://junglewise.ai/threats/technologies/learning): 10 vulnerabilities - [Frappe HR](https://junglewise.ai/threats/technologies/hr): 9 vulnerabilities - [Frappe Crm](https://junglewise.ai/threats/technologies/frappe-crm): 6 vulnerabilities - [Frappe Learning Management System](https://junglewise.ai/threats/technologies/learning-management-system): 5 vulnerabilities - [Frappe Builder](https://junglewise.ai/threats/technologies/frappe-builder): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Frappe Framework vulnerabilities", https://junglewise.ai/threats/technologies/frappe, 13 November 2026.