Critical · 9.6 CVE-2025-67289 EUVD-2025-204727GHSA-9924-rxm2-pj79

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code vi…

Published Dec 22, 2025 · Updated Jul 5, 2026 · Assigned by mitre

Description

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

References

https://github.com/vuquyen03/CVE/blob/main/CVE-2025-67289/README.md