Description
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.
Published: 2026-07-29
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Frappe’s ERPNext allows an authenticated user to inject arbitrary SQL through the Supplier record name field. The application builds SQL statements using string interpolation without parameterization, so characters that change query semantics can be interpreted by the database. This leads to arbitrary SQL execution and the ability to bypass normal document permissions, exposing sensitive data such as password hashes, integration tokens, and financial records.

Affected Systems

The vulnerability affects Frappe ERPNext versions 15.107.0 and 15.107.2. The issue has been fixed in release 15.111.0 and 16.22.0.

Risk and Exploitability

The CVSS base score of 7.1 indicates a high impact risk. An EPSS figure of less than 1% suggests exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be through the web interface by any authenticated user, even with low privileges, who can supply a Supplier name containing SQL metacharacters to trigger the injection.

Generated by OpenCVE AI on August 3, 2026 at 13:28 UTC.

Remediation

Vendor Solution

The vulnerability has been fixed by the Frappe team in versions 15.111.0 and 16.22.0.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch by upgrading to ERPNext 15.111.0 or a newer release that contains the fix.
  • If an immediate upgrade is not possible, restrict creation and editing of Supplier records to users with high‑privilege roles only, and enforce input validation that removes or escapes SQL metacharacters from the Supplier name field.
  • Monitor database logs for anomalous queries and deploy a Web Application Firewall rule that blocks HTTP requests containing common SQL injection patterns.

Generated by OpenCVE AI on August 3, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe erpnext
Vendors & Products Frappe
Frappe erpnext

Wed, 29 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Description SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.
Title SQL Injection in Frappe's ERPNext
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-07-29T12:07:55.509Z

Reserved: 2026-06-22T12:58:30.777Z

Link: CVE-2026-12895

cve-icon Vulnrichment

Updated: 2026-07-29T12:07:48.249Z

cve-icon NVD

Status : Deferred

Published: 2026-07-29T11:16:47.227

Modified: 2026-07-30T14:12:18.697

Link: CVE-2026-12895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T13:30:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')