SQL Injection Vulnerability Detected in Frappe's ERPNext
INCIBE reported on July 29, 2026, about an SQL injection vulnerability in ERPNext by Frappe, an enterprise resource planning system. The finding was made by Alejandro Ramos and coordinated for disclosure by INCIBE.
Identification and Technical Characteristics of Vulnerability CVE-2026-12895
The vulnerability affects versions prior to 15.111.0 of ERPNext and 16.22.0 of Frappe, specifically including ERPNext 15.107.0 and Frappe 15.107.2. It has been assigned the identifier CVE-2026-12895 and a base CVSS v4.0 score of 7.1, classified as high severity.
The flaw lies in the construction of SQL queries using direct string interpolation with str.format(), without the use of parameterized queries. This allows the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query.
Potential Impact of SQL Injection in ERPNext
Exploiting this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries. This includes the possibility of bypassing the access restrictions of the Frappe system (DocPerm) and extracting sensitive data from the database.
The data that could be affected includes fragments of the administrator's password hash, as well as credentials, integration tokens, and financial information.
Fix and Updated Versions
The Frappe team has resolved the vulnerability in versions 15.111.0 of ERPNext and 16.22.0 of Frappe. These versions address the issue found in the construction of SQL queries.
Monitoring and Additional Details
INCIBE continues to monitor this vulnerability and has published a notice with technical details and affected versions. It is classified under the CWE-89 code, corresponding to SQL injection.
The CVSS vector indicates that exploitation does not require user interaction, but does require limited privileges in the system to carry it out.
Official information is available on the INCIBE-CERT portal, the national cybersecurity incident response center.
Technical Details on Query Construction in ERPNext
The SQL injection vulnerability in Frappe's ERPNext is due to the way the application constructs SQL queries. Specifically, it uses the str.format() function to directly interpolate strings, without employing parameterized queries. This technique allows the value of the docname field of a Supplier record, if it contains SQL metacharacters, to be interpreted as part of the executed SQL code.
Exploiting this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe's access restrictions (DocPerm), and extract confidential information from the database, including fragments of the administrator's password hash, as well as access other sensitive data such as credentials, integration tokens, or financial information.
More information can be found at the original source.
Published: 03/08/2026. Content reviewed using experience, authority and trustworthiness criteria (E-E-A-T).
This article may have used artificial intelligence tools to support structure, editing, translation or review. Editorial responsibility and final review remain with Toni Berraquero. View AI policy
You can support the project or share this article in one click. At least this block does something useful.