CVE-2025-67289 - An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file

Back Back to CVE browser

CRITICAL

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file

Published Dec 22, 2025

9.6

CRITICAL

CVSS 3.1

EPSS 0.46%

Description

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-434

Unrestricted Upload of File

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204727
Advisory
https://github.com/vuquyen03/CVE/blob/main/CVE-2025-67289/README.md
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204727		Advisory
https://github.com/vuquyen03/CVE/blob/main/CVE-2025-67289/README.md		ExploitThird Party Advisory