CVE-2025-66206

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.86.0 Frappe versions prior to 14.99.2

Description Frappe, a full-stack web application framework, had requests vulnerable to path traversal attacks in versions prior to 15.86.0 and 14.99.2. This allowed retrieval of server files if the full path was known. Sites hosted on Frappe Cloud and setups using a reverse proxy like NGINX were not affected. The issue primarily impacted those directly using werkzeug/gunicorn.

Recommendations Upgrade to Frappe version 15.86.0. Upgrade to Frappe version 14.99.2. If upgrading is not immediately possible, change the setup to use a reverse proxy like NGINX.