CVE-2025-65267
CriticalSummary
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link, resulting in stored XSS. This may lead to account takeover, privilege escalation, or full compromise of the ERPNext instance.
Risk Assessment
An attacker can take over an administrator account or gain full control of the ERPNext system, potentially leading to confidentiality and integrity breaches of business data.
Recommendation
Update ERPNext and Frappe Framework to the latest versions. Implement file type validation and restrict SVG uploads.
Original NVD description (English source)
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.