Frappe Remote Code Execution Vulnerability via Server-Side Template Injection

A remote code execution vulnerability has been identified in the Frappe web application framework, affecting versions prior to 14.99.6 and 15.88.1. The issue arises from server-side template injection, where an authenticated user with specific permissions could be manipulated into clicking a specially crafted link. This would result in the execution of a malicious template on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Frappe is hosted.

Remediation

Users are advised to upgrade to Frappe versions 14.99.6 or 15.88.1, both of which address this vulnerability.