Frappe Framework EUVD-2026-36454

The attacker must have the ability to set or update a profile image in the Frappe instance - in most deployments this requires an authenticated user account, making PR:L the realistic privilege level despite the PR:N in the provided CVSS 4.0 vector. A victim user must subsequently navigate to and render the attacker's profile page, providing the trigger for script execution. Exploitation is limited to Frappe instances running versions prior to 15.106.0. If the Frappe deployment restricts public self-registration, the pool of potential attackers is limited to existing credentialed users. No specific non-default configuration is required beyond a standard Frappe installation with user profiles accessible to other users.

The CVSS 4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N warrants scrutiny: the PR:N (no privileges required) and UI:N metrics are inconsistent with the described attack scenario, which involves an attacker uploading a malicious profile image - an action that typically requires an authenticated session in Frappe. Additionally, stored XSS inherently requires a victim to navigate to the affected page (implying at least passive user interaction, UI:P in CVSS 4.0 terms). These metric choices should be verified against the vendor advisory at GHSA-2wx6-8gmq-x4fw. EPSS at 0.02% confirms no significant observed exploitation, and the absence of a KEV listing or public POC further tempers urgency. Despite a relatively high numerical score, the real-world risk depends heavily on whether unauthenticated account creation is permitted in a given Frappe deployment - if registration is restricted, the attack surface is narrowed to existing users.

An attacker with a Frappe account crafts a profile image upload containing an embedded JavaScript payload that evades server-side sanitization. When a legitimate user - such as an administrator or coworker - navigates to the attacker's profile page, the malicious script executes silently in their browser, potentially exfiltrating session cookies or CSRF tokens to an attacker-controlled server. No public proof-of-concept exists at time of analysis, but the attack mechanics are well-understood for stored XSS.