This vulnerability in Frappe Framework v15.89.0's Attachments module permits an attacker to upload a maliciously crafted XML file, resulting in arbitrary code execution. The issue stems from improper handling of uploaded files, categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-79 (Cross-site Scripting). The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and monitor for suspicious file uploads. Avoid allowing untrusted users to upload files, especially XML files, and consider disabling the Attachments module if feasible.