# CVE-2026-114664: Frappe Framework blind SQL injection in get_events method

Source: https://junglewise.ai/threats/cve-2026-114664-frappe-framework-before-16-33-0-contains-a-blind-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114664 · Severity: high · CVSS 7.1 · Published 2026-10-22

Frappe Framework is a web application framework used to build enterprise business applications. A blind SQL injection vulnerability in its event calendar functionality allows authenticated users to extract sensitive database information by crafting malicious input and observing application behavior. This could lead to unauthorized access to confidential data stored in the application's database.

Technologies: [Frappe Framework](https://junglewise.ai/threats/technologies/frappe). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2026-114664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114664 being exploited in the wild.

**How severe is CVE-2026-114664?** High severity, with a CVSS score of 7.1, published 22 October 2026.

**Which products and versions are affected?** Frappe Framework before 16.33.0.

**Is there a fix for CVE-2026-114664?** Yes: fixed in 16.33.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114664 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114664?** Check whether you run Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 16.33.0

## Technical details

A blind SQL injection vulnerability exists in the frappe.desk.doctype.event.event.get_events method due to improper neutralization of user-supplied input in SQL queries. The vulnerability is accessible to authenticated attackers who can send crafted input to the get_events endpoint and infer database query results from application behavior patterns. This allows attackers to extract sensitive database information without direct query result visibility.

## Affected products

- Frappe Framework before 16.33.0

## Timeline

- 2026-10-07: disclosed
- 2026-10-22: advisory

## References

- [https://github.com/frappe/frappe/security/advisories/GHSA-p4w2-9mr5-6prj](https://github.com/frappe/frappe/security/advisories/GHSA-p4w2-9mr5-6prj)
- [https://www.vulncheck.com/advisories/frappe-before-16.33.0-blind-sql-injection-via-get-events](https://www.vulncheck.com/advisories/frappe-before-16.33.0-blind-sql-injection-via-get-events)

## Related threats

- [Frappe Framework arbitrary file read in outgoing email HTML](https://junglewise.ai/threats/cve-2026-109601-frappe-framework-before-15-117-0-and-16-x-before-16-30-0)
- [Frappe Framework missing authorization in Document Follow email notifications](https://junglewise.ai/threats/cve-2026-109600-frappe-framework-before-15-118-0-and-16-x-before-16-31-0-does)
- [Frappe Framework missing authorization in send_sms API](https://junglewise.ai/threats/cve-2026-109598-frappe-framework-before-15-120-0-and-16-x-before-16-33-0)