VYPR
← All advisories
Critical severity9.0OSV Advisory· Published Dec 3, 2025· Updated Jun 17, 2026

CVE-2025-65267

CVE-2025-65267

Description

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Frappe/ErpnextOSV3 versions
    4.0.0, 4.0.0-beta1, v10.0.0, …+ 2 more
    • (no CPE)range: 4.0.0, 4.0.0-beta1, v10.0.0, …
    • cpe:2.3:a:frappe:erpnext:15.83.2:*:*:*:*:*:*:*
    • (no CPE)range: v15.83.2
  • Frappe/Frappe2 versions
    cpe:2.3:a:frappe:frappe:15.86.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:frappe:frappe:15.86.0:*:*:*:*:*:*:*
    • (no CPE)range: v15.86.0
  • Frappe/Frappe Frameworkllm-fuzzy
    Range: v15.86.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.