Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2025-71431: Frappe lets attackers inject LDAP commands via unsafe inputs
CVE-2025-71431 · published 23 days ago
Summary
Versions of Frappe older than 15.86.0 (and older than 14.99.2) accept user data for certain web requests without cleaning it before building LDAP searches. An attacker could craft special input to change those searches, potentially exposing or altering directory information. Update Frappe to the latest release or apply the vendor's patch to protect against this.
Original advisory text
Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71431... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-71431 Vendor Advisory
- https://www.vulncheck.com/advisories/frappe-before-15.86.0-ldap-injection-via-un... Vendor Advisory
- https://github.com/frappe/frappe/security/advisories/GHSA-qrq5-v93p-8xhw Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Timeline
Published12 Oct 2026
Updated4 Nov 2026
First seen12 Oct 2026
Track software like this
Free during beta