CVE-2025-66206

{
  "id": "CVE-2025-66206",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-01T21:15:52.623",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2."
    },
    {
      "lang": "es",
      "value": "Frappe es un framework de aplicación web full-stack. Versiones anteriores a la 15.86.0 y 14.99.2, ciertas solicitudes eran vulnerables a ataques de salto de ruta, mediante los cuales algunos archivos del servidor podían ser recuperados si se conocía la ruta completa. Los sitios alojados en Frappe Cloud, e incluso otras configuraciones que están detrás de un proxy inverso como NGINX, no se ven afectados. Esto afectaría principalmente a quienes utilizan directamente werkzeug/gunicorn. En esos casos, se recomienda una actualización o cambiar la configuración para usar un proxy inverso. Esta vulnerabilidad está corregida en las versiones 15.86.0 y 14.99.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "frappe",
          "product": "frappe",
          "versions": [
            {
              "version": ">= 15.0.0, < 15.86.0",
              "status": "affected"
            },
            {
              "version": "< 14.99.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-01T20:36:49.667141Z",
          "id": "CVE-2025-66206",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "14.99.2",
              "matchCriteriaId": "5F7C6678-1529-4C46-BF75-8647AF1170C9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "15.0.0",
              "versionEndExcluding": "15.86.0",
              "matchCriteriaId": "63006503-DD78-47D9-ACDE-9D3480FAE9F6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/frappe/frappe/security/advisories/GHSA-v4wg-gqfr-rpjm",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}