Executive brief
Frappe, a web application framework used to build business software like ERPNext, contains a security vulnerability in its blog management component. An attacker could potentially use this flaw to run unauthorized database commands, which might allow them to view or modify sensitive information. This issue affects organizations using Frappe to host blogs or web content and has been resolved in the latest software updates.
Technical details
A SQL injection vulnerability exists in the Frappe Framework within the 'get_blog_list' function. The flaw stems from improper neutralization of special elements used in SQL commands (CWE-89), allowing an unauthenticated remote attacker to inject malicious SQL queries. This affects Frappe Framework versions prior to 15.106.0 and 16.16.0, as well as the standalone Frappe Blog application. Successful exploitation could lead to unauthorized data retrieval or modification. The issue is patched in versions 15.106.0 and 16.16.0.
Affected products
- Frappe Frappe Framework < 15.106.0, < 16.16.0
- Frappe Frappe Blog All versions prior to the fix in Frappe Framework 16.16.0
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD