CVE-2025-65267

critical · 9

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.

CVSS

0.3%

EPSS (exploit prob.)

28th

EPSS percentile

2025-12-03

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
frappe	erpnext	15.83.2
frappe	frappe	15.86.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/PhDg1410/CVE/tree/main/CVE-2025-65267
https://github.com/frappe/erpnext
https://github.com/frappe/frappe

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-65267