CVE-2025-68953

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-689545.4Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a useCVE-2025-689554.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avCVE-2025-689564.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaCVE-2025-689574.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaCVE-2025-689584.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaCVE-2025-689595.5Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect sCVE-2025-68968.8A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.CVE-2025-689604.7Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect avCVE-2025-689614.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-689624.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-689635.3Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confideCVE-2025-689645.5Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-68953: High severity, CVSS 7.5 | Vulnix