Frappe Framework CVE-2026-50704

Q: What is the CVSS score of CVE-2026-50704?

CVE-2026-50704 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38800 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Fluid Attacks

GHSA-x573-2rr6-86rc

XSS Frappe Frappe Framework

4.6

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

PR:H because payload injection requires high-privilege file access; S:C and UI:R because impact occurs in victim's browser session after active navigation.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 15:54 vuln.today

DescriptionCVE.org

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer.

AnalysisAI

Stored XSS in Frappe Framework 17.0.0-dev allows a high-privileged attacker to inject persistent malicious scripts into the File View breadcrumb renderer, which then execute in the browsers of other users who navigate to the affected view. The CVSS 4.0 vector (PR:H, UI:A, SC:L/SI:L) confirms that while network delivery is possible, exploitation is constrained by the need for elevated access to inject the payload and victim interaction to trigger it, with impact limited to the subsequent system (victim browser). No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Frappe Framework is an open-source Python/JavaScript full-stack web framework (cpe:2.3:a:frappe:frappe_framework) primarily used as the foundation for ERPNext and other Frappe-ecosystem applications. The vulnerability resides in the File View component's breadcrumb rendering logic, which fails to properly neutralize user-controlled input before rendering it in the browser - the classic root cause of CWE-79 (Improper Neutralization of Input During Web Page Generation). Because the payload is stored server-side and later rendered to any user visiting the File View, this is a Stored (Persistent) XSS variant, which is more dangerous than Reflected XSS as it does not require the attacker to trick the victim into clicking a crafted link. The affected version, 17.0.0-dev, is a development-track release, suggesting this was caught during active development.

RemediationAI

No vendor-released patch with an exact fix version has been identified in the available data. The upstream source repository at https://github.com/frappe/frappe should be monitored for commits or tagged releases addressing the File View breadcrumb input sanitization issue. Organizations running Frappe 17.0.0-dev in any environment should apply output encoding or sanitization controls on the breadcrumb renderer as a compensating control - specifically, ensuring that any user-supplied file or folder names are HTML-escaped before rendering in the DOM. A practical short-term control is to restrict the ability to upload or rename files to the minimum set of trusted high-privilege users, reducing the pool of accounts that could plant a payload. Upgrading away from development-track releases to a stable Frappe release that includes a fix is strongly recommended once available. The Fluid Attacks advisory at https://fluidattacks.com/es/advisories/molotov should be monitored for disclosure of the fix timeline.