by Kastro
Paper/Archive/CVE-2025-65267

CVE-2025-65267

mitre — In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious…

EPSS 0.3%CVSS 9.0
critical.is priorityof 100
33
CVSS 9.0 (ADP)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 28.3.283 × 205.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/frappe/frapperefgithub.com/frappe/erpnextrefgithub.com/PhDg1410/CVE/tree/main/CVE-2025-65267