EUVD-2026-50294Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with a low-privilege authenticated account (PR:L, AV:N, AC:L); high confidentiality from arbitrary data extraction, no integrity impact stated, limited availability impact from arbitrary SQL.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
Lifecycle Timeline
3DescriptionCVE.org
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format() without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database-including fragments of the administrator’s password hash-and access other sensitive data, such as credentials, integration tokens, or financial information.
AnalysisAI
SQL injection in Frappe's ERPNext (ERPNext 15.107.0, Frappe framework 15.107.2) lets an authenticated low-privilege user run arbitrary SQL by placing SQL metacharacters in the name (docname) of a Supplier record, which is later interpolated into a query via str.format() instead of being parameterized. Because the injected query runs with the application's database privileges, an attacker can bypass Frappe's DocPerm access controls and read data they should not see, including fragments of the administrator's password hash, stored credentials, integration tokens, and financial records. Per the CVSS 4.0 vector the flaw is network-reachable with low attack complexity and only low privileges (PR:L), and there is no public exploit identified at time of analysis.
Technical ContextAI
Frappe is a Python full-stack web framework and ERPNext is the ERP application built on top of it; both share a MariaDB/MySQL-backed document (DocType) data model where each record has a 'name' primary key (docname). The root cause is CWE-89 (SQL Injection): a query is assembled by direct string interpolation using Python's str.format() rather than the framework's parameterized query API (frappe.db.sql with bound parameters), so a Supplier docname carrying SQL metacharacters escapes its intended string context and is parsed as SQL. Because the query executes under the ORM/database connection rather than through Frappe's DocPerm permission layer, the injection also acts as an authorization bypass, exposing data across DocTypes the low-privilege user could not normally read.
RemediationAI
No vendor-released patch version was identified at time of analysis; consult the INCIBE-CERT notice (https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-frappes-erpnext) and the Frappe/ERPNext security channel for the fixed release and upgrade to it once published, since the underlying fix is to replace the str.format()-based query construction with Frappe's parameterized frappe.db.sql bindings. As compensating controls until a patched build is deployed, restrict who can create or rename Supplier records by tightening DocPerm/role permissions on the Supplier DocType (trade-off: may block legitimate procurement workflows), enforce strict input validation or a naming series that rejects SQL metacharacters in Supplier names, minimize the number of accounts with any authenticated access, and increase database and application query logging to detect anomalous Supplier docnames or unexpected query patterns.
Same weakness CWE-89 – SQL Injection
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today