EUVD-2026-43101Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default MySQL FILE privilege prerequisite; PR:L confirms authentication required; no confidentiality or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.
AnalysisAI
Frappe framework's check_safe_sql_query function fails to block SELECT INTO OUTFILE statements, allowing authenticated low-privileged users to write arbitrary files to the server filesystem on self-hosted MySQL deployments where the database user holds the MySQL FILE privilege. Affected branches are v15 prior to 15.108.0 and v16 prior to 16.18.3; fixes are released at both version targets. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, with a CVSS 4.0 base score of 2.3 reflecting the narrow, non-default exploitation conditions captured by AT:P.
Technical ContextAI
Frappe (cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*) is a Python-based full-stack web framework underlying ERPNext and other applications. It exposes a check_safe_sql_query function intended to act as a safety filter, blocking dangerous SQL constructs before execution. CWE-89 (SQL Injection) identifies the root cause: an incomplete denylist that failed to intercept the SELECT INTO OUTFILE statement variant. SELECT INTO OUTFILE is a MySQL-specific extension that directs query output to a server-side file path, requiring the MySQL FILE privilege on the database user account - a non-default grant not present in cloud-managed or hardened deployments. PostgreSQL and MariaDB configurations do not expose this specific MySQL FILE privilege pathway.
RemediationAI
Upgrade Frappe to version 16.18.3 (v16 branch) or 15.108.0 (v15 branch), both of which resolve the check_safe_sql_query bypass; release artifacts are available at https://github.com/frappe/frappe/releases/tag/v16.18.3 and https://github.com/frappe/frappe/releases/tag/v15.108.0, with underlying fixes landed via PRs #39345 and #39346 (commits 628e103f and 91d3ded0). As an immediate compensating control for environments that cannot patch promptly, revoke the MySQL FILE privilege from the Frappe database user (REVOKE FILE ON *.* FROM 'frappe_db_user'@'host'); this directly eliminates the exploitation pathway for SELECT INTO OUTFILE and is low-risk since the FILE privilege is not required for standard Frappe or ERPNext operation. Additionally, audit all MySQL user grants on self-hosted instances to confirm FILE is absent across all application-tier accounts - a best-practice baseline independent of this CVE.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today