Executive brief
Frappe ERPNext, an enterprise resource planning system used for managing business operations, contains a security vulnerability that could allow unauthorized data access. An attacker with low-level user access can manipulate database queries to bypass security restrictions and view sensitive information. This could lead to the exposure of administrator password hashes, financial records, and integration tokens, potentially compromising the entire business management platform.
Technical details
A SQL injection vulnerability exists in Frappe ERPNext due to improper neutralization of special elements in SQL commands (CWE-89). The application uses direct string interpolation via `str.format()` instead of parameterized queries when processing the `docname` of a Supplier record. An authenticated attacker with low privileges can inject SQL metacharacters into the Supplier record name to bypass DocPerm access restrictions. Successful exploitation allows for the extraction of sensitive database information, including administrator password hashes and integration tokens. The issue is resolved in ERPNext versions 15.111.0 and 16.22.0.
Affected products
- Frappe ERPNext prior to 15.111.0, prior to 16.22.0
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched