Frappe CVE-2026-35614

Remote unauthenticated attacker can exploit SQL injection in Frappe's bulk_update function. Affects Frappe versions prior to 16.14.0 and 15.104.0. No special configuration or victim interaction required. Default installations are vulnerable.

This vulnerability presents critical real-world risk. The CVSS 9.3 score accurately reflects severity: unauthenticated network access (AV:N/PR:N), low complexity (AC:L), and complete confidentiality/integrity/availability impact (VC:H/VI:H/VA:H) make this immediately exploitable. SQL injection is a mature attack technique with abundant tooling (sqlmap, manual exploitation), meaning even moderate-skill attackers can weaponize this flaw once discovered. While no public exploit identified at time of analysis, the GitHub Security Advisory disclosure means proof-of-concept details may emerge rapidly. The bulk_update endpoint likely accepts JSON/POST data, making automated scanning and exploitation straightforward. Organizations running Frappe-based applications (ERPNext, custom deployments) face data breach risk, unauthorized access to business records, and potential lateral movement if database credentials enable OS-level access. The availability of patches in versions 16.14.0 and 15.104.0 provides clear remediation path, elevating this to urgent priority for any internet-facing Frappe installation.

An unauthenticated attacker identifies a Frappe-based application exposed to the internet and targets the bulk_update API endpoint with crafted HTTP POST requests containing SQL injection payloads in parameters processed by the vulnerable function. By injecting UNION-based or Boolean-based blind SQL syntax, the attacker extracts database schema information, then systematically dumps sensitive tables containing customer records, financial data, user credentials, and business intelligence. With database admin privileges often granted to application database users, the attacker leverages SQL injection to execute operating system commands via MySQL/MariaDB's INTO OUTFILE or UDF mechanisms, achieving remote code execution and establishing persistent access to the underlying server infrastructure.