CVE-2025-65267
📋 TL;DR
This vulnerability allows attackers to upload malicious SVG avatar images containing JavaScript payloads in ERPNext and Frappe Framework. When an administrator clicks to view the avatar, the JavaScript executes, enabling stored cross-site scripting attacks. All organizations using affected versions of ERPNext or Frappe Framework are at risk.
💻 Affected Systems
- ERPNext
- Frappe Framework
📦 What is this software?
Erpnext by Frappe
Frappe by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the ERPNext instance through administrator account takeover, leading to data theft, privilege escalation, and complete system control.
Likely Case
Administrator account compromise leading to unauthorized access, data manipulation, and potential privilege escalation within the ERP system.
If Mitigated
Limited impact with proper input validation and content security policies in place, potentially blocking malicious SVG execution.
🎯 Exploit Status
Exploitation requires user interaction (administrator clicking the image) but the SVG payload creation is straightforward. Public proof-of-concept exists in the GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ERPNext v15.83.3+, Frappe Framework v15.86.1+
Vendor Advisory: https://github.com/frappe/erpnext
Restart Required: No
Instructions:
1. Update ERPNext to v15.83.3 or later. 2. Update Frappe Framework to v15.86.1 or later. 3. Verify the patch by testing SVG upload functionality.
🔧 Temporary Workarounds
Disable SVG Avatar Uploads
allTemporarily disable SVG file uploads for avatar images until patching is complete.
Modify Frappe Framework configuration to restrict avatar uploads to non-SVG formats only.
Implement Content Security Policy
allAdd Content Security Policy headers to prevent inline script execution from SVG files.
Add 'Content-Security-Policy: script-src 'self'' header to web server configuration.
🧯 If You Can't Patch
- Implement strict input validation to sanitize SVG files before processing.
- Restrict avatar upload permissions to trusted users only and monitor upload activity.
🔍 How to Verify
Check if Vulnerable:
Check if current ERPNext version is v15.83.2 or earlier, or Frappe Framework is v15.86.0 or earlier.Check Version:
bench versionVerify Fix Applied:
Verify installation of ERPNext v15.83.3+ or Frappe Framework v15.86.1+ and test SVG upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Multiple failed avatar upload attempts
- Administrator account login from unexpected locations
Network Indicators:
- HTTP requests containing malicious SVG payloads in uploads
- Unusual outbound connections after avatar view
SIEM Query:
source="web_logs" AND (uri_path="/api/method/upload_file" OR uri_path CONTAINS "/files/") AND file_extension="svg" AND size>100KB