CVE-2026-50704 is a stored XSS vulnerability in Frappe Framework 17.0.0-dev caused by improper neutralization of user input in the File View breadcrumb renderer. This allows attackers with high privileges and user interaction to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 4.6 (medium) and no vendor advisory or patch is currently available.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users who view the affected breadcrumb component. This could lead to actions such as session hijacking or unauthorized actions performed in the context of the victim user. However, exploitation requires user interaction and high privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected version and avoid exposing the vulnerable component to untrusted users. Monitor for updates from the Frappe project regarding official patches or mitigations.