CVE-2025-71431

Deferred Deferred - Pending Action

LDAP Injection in Frappe Framework

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2025-71431

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	15.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Frappe versions before 14.99.2 and 15.x before 15.86.0 have an LDAP injection vulnerability. This occurs because certain endpoints do not properly sanitize user input before using it in LDAP queries. Attackers can exploit this by injecting crafted LDAP filter syntax through these parameters to manipulate the directory queries.

Detection Guidance

To detect LDAP injection vulnerabilities in Frappe, inspect network traffic for LDAP queries containing unusual filter syntax or user-supplied parameters. Check application logs for malformed LDAP filter patterns in requests to affected endpoints. Use tools like Wireshark to capture and analyze LDAP traffic for suspicious input patterns.

Impact Analysis

An attacker could exploit this vulnerability to read unauthorized data from the LDAP directory, modify directory contents, or perform other unauthorized actions depending on the LDAP server's configuration. This could lead to data breaches or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected Frappe versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade Frappe to version 14.99.2 or later for the 14.x branch, or to 15.86.0 or later for the 15.x branch. Review and sanitize all user-supplied parameters used in LDAP queries. Implement input validation to reject LDAP filter syntax characters in user inputs. Monitor LDAP query logs for unexpected filter patterns.

Hi! I’m here to help you understand CVE-2025-71431. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70