CVE-2026-50704: Frappe Framework Stored XSS Vulnerability

CVE-2026-50704 Overview

CVE-2026-50704 is a Stored Cross-Site Scripting (XSS) vulnerability in Frappe Framework version 17.0.0-dev. The flaw resides in the File View breadcrumb renderer, which fails to properly neutralize user-controlled input before rendering it in the browser. An authenticated attacker with high privileges can inject malicious script payloads that execute in the context of any user who later views the affected File View. The vulnerability is classified under CWE-79 and was disclosed through a Fluid Attacks advisory. Successful exploitation requires user interaction and yields limited confidentiality and integrity impact on the subsequent victim's session.

Critical Impact
Authenticated attackers can store malicious JavaScript in File View breadcrumbs, executing arbitrary script in victim browsers when they navigate to the affected view.

Affected Products

Frappe Framework version 17.0.0-dev
Applications and ERPNext deployments built on the affected Frappe Framework release
File View breadcrumb renderer component

Discovery Timeline

2026-06-24 - CVE-2026-50704 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50704

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the Frappe Framework File View component. The breadcrumb renderer takes user-controlled input, such as a file or folder name, and inserts it into the rendered DOM without applying proper output encoding or sanitization. When another user navigates to a File View containing the malicious entity, the injected payload executes within their authenticated session context.

Frappe Framework is the open-source Python and JavaScript framework that powers ERPNext and other business applications. Because the File View is a shared workspace primitive, payloads stored by one authenticated user can reach administrators or other staff members who interact with the same resource. The advisory was published by Fluid Attacks.

Root Cause

The root cause is improper neutralization of input during web page generation, mapped to [CWE-79]. The breadcrumb rendering logic in the File View concatenates user-supplied strings directly into HTML output. The framework does not escape HTML control characters such as <, >, and quotation marks before insertion. As a result, script tags and event-handler attributes contained in stored values are interpreted as executable markup by the browser.

Attack Vector

The attack vector is network-based and requires high privileges plus user interaction. An attacker with authenticated access creates or renames a file or folder so that its name contains an XSS payload. The payload is persisted in the Frappe database. When a second user with sufficient access browses to the File View, the breadcrumb renderer outputs the malicious name and the script executes in that user's browser. The attacker can use this to alter rendered UI elements, leak session-scoped tokens, or perform actions on behalf of the victim within the application.

No verified public proof-of-concept code is available for this issue. Refer to the Fluid Attacks Advisory and the GitHub Repository for Frappe for technical context.

Detection Methods for CVE-2026-50704

Indicators of Compromise

File or folder names in the Frappe database containing HTML tags, <script> elements, or JavaScript event handlers such as onerror= or onload=.
Unexpected outbound HTTP requests from authenticated user browsers to attacker-controlled domains shortly after accessing File View pages.
Audit log entries showing renames or uploads of File records with unusually long or HTML-encoded names.

Detection Strategies

Inspect the tabFile table and related DocTypes for stored values containing angle brackets, quotes, or javascript: URIs.
Enable Content Security Policy (CSP) reporting and monitor script-src violations originating from File View routes.
Review web server logs for File View page accesses that correlate with newly created or renamed File records from low-trust accounts.

Monitoring Recommendations

Alert on creation or modification of File DocType records whose file_name field matches XSS-like patterns.
Monitor browser-side error telemetry and CSP violation reports for unexpected inline script execution on File View URLs.
Track privilege use by accounts that create File records, focusing on accounts that should not normally manage shared storage.

How to Mitigate CVE-2026-50704

Immediate Actions Required

Restrict File creation and rename permissions in Frappe to trusted roles until a patched version is deployed.
Audit existing File records for names containing HTML or script content and sanitize or remove offending entries.
Avoid running production workloads on the 17.0.0-dev development build of Frappe Framework.

Patch Information

At the time of publication, no fixed version is identified in the NVD entry for CVE-2026-50704. Track the upstream GitHub Repository for Frappe for commits to the File View breadcrumb renderer and consult the Fluid Attacks Advisory for vendor remediation status. Apply the official patch as soon as it is released and redeploy any sites running affected builds.

Workarounds

Downgrade from 17.0.0-dev to the latest stable Frappe Framework release that is not affected by this issue.
Deploy a strict Content Security Policy that disallows inline scripts and limits script-src to trusted origins.
Apply a reverse-proxy or WAF rule that blocks request bodies containing HTML or script markup destined for File DocType endpoints.

bash

# Example CSP header to mitigate stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";