CVE-2025-67289
📋 TL;DR
This critical vulnerability in Frappe Framework's Attachments module allows attackers to upload malicious XML files that can lead to remote code execution. It affects all systems running Frappe Framework v15.89.0. Attackers can potentially take full control of affected servers.
💻 Affected Systems
- Frappe Framework
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, deploy ransomware, or pivot to other systems in the network.
Likely Case
Webshell deployment leading to data exfiltration, credential theft, and lateral movement within the network.
If Mitigated
Limited impact if file uploads are restricted to authenticated users only and input validation is implemented.
🎯 Exploit Status
Exploit requires file upload capability but is straightforward once access is obtained. XML file parsing leads to code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v15.90.0 or later
Vendor Advisory: http://frappe.com
Restart Required: Yes
Instructions:
1. Backup your Frappe instance. 2. Update Frappe Framework to v15.90.0 or later using 'bench update'. 3. Restart all services with 'bench restart'. 4. Verify the update with 'bench version'.
🔧 Temporary Workarounds
Disable XML file uploads
allConfigure the Attachments module to reject XML file uploads entirely
Modify site_config.json to add: {"file_upload_restrictions": {"blocked_extensions": ["xml"]}}
Implement file type validation
allAdd server-side validation to check file content, not just extensions
Add custom validation in hooks.py to inspect file magic numbers
🧯 If You Can't Patch
- Implement WAF rules to block XML file uploads to the attachments endpoint
- Restrict file upload permissions to trusted users only and monitor upload activity
🔍 How to Verify
Check if Vulnerable:
Check Frappe version with: bench version | grep frappeCheck Version:
bench versionVerify Fix Applied:
Confirm version is v15.90.0 or later: bench version📡 Detection & Monitoring
Log Indicators:
- XML file uploads to /api/method/upload_file
- Unusual file size or content in upload logs
- Execution of system commands from web process
Network Indicators:
- POST requests with XML files to upload endpoints
- Outbound connections from web server to unknown IPs
SIEM Query:
source="frappe.log" AND "upload_file" AND file_extension="xml"