A stored cross‑site scripting vulnerability exists in the user profile image upload feature of the Frappe framework. By uploading a crafted image that contains malicious script code, an attacker can inject executable payloads into the database. When other users view the profile, the malicious script runs in their browsers, potentially enabling the theft of session cookies, credentials, or other sensitive data, and may also serve as a vector for further malware delivery. The weakness is classified as CWE‑79.

Vulnerable installations are those running any release of the Frappe framework prior to version 15.106.0. The issue was patched in that release; therefore any deployments using older 15.x releases, or earlier series, are at risk. All users who can upload or manage their profile image are affected, and any other users who view those profiles can be impacted.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1 % suggests that exploitation is considered unlikely, and the vulnerability is not currently listed in the CISA KEV catalogue. However, an attacker with access to upload a malicious image can place code that will run in the context of other users merely by them visiting the profile page. The vulnerability is broadly exploitable to any other authenticated or publicly visible user and carries no requirement for elevated privileges beyond the ability to upload a profile image.