CVE-2025-71431

5.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-90

Impact

Remote attackers can extract directory information by injecting crafted LDAP filter syntax into vulnerable endpoints. This requires network access to the Frappe instance without any prior authentication.

Root cause

Frappe passes unsanitized user-supplied parameters directly into LDAP queries.

Affected systems

Frappe versions before 14.99.2 and 15.x before 15.86.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Frappe to version 14.99.2, 15.86.0, or later. If patching immediately is not possible, disable LDAP integration in Frappe settings or restrict network access to affected endpoints.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.

References

Source: nvd.nist.gov/vuln/detail/CVE-2025-71431