Junglewise Threat Intelligence

CVE-2026-47199: Frappe Framework SQL injection via SELECT INTO OUTFILE in safe_exec

CVE-2026-47199 · Severity: info · CVSS 2.3 · Published 2026-07-10

Technologies: Frappe Technologies Frappe Framework. Vendors: Frappe, Frappe Technologies.

Executive brief

Frappe, a web application framework, contained a security flaw where its database query safety checker failed to block commands that export data to files. On self-hosted systems with specific database configurations, a logged-in user could potentially use this to write data to the server's file system. This could lead to unauthorized data exports or local file creation if the database service has excessive permissions.

Technical details

A SQL injection vulnerability exists in the Frappe Framework's 'check_safe_sql_query' utility. Prior to the fix, the function's blacklist did not account for 'SELECT INTO OUTFILE' or 'DUMPFILE' statements, which are used to export query results to the server's local file system. An attacker with low-level privileges (PR:L) could execute these queries in restricted contexts if the underlying MySQL/MariaDB user has the 'FILE' privilege and directory permissions are poorly aligned. The vulnerability is addressed by adding regex-based validation to block these export keywords in 'frappe/utils/safe_exec.py'.

Affected products

  • Frappe Frappe Framework < 15.108.0, >= 16.0.0-beta.1, < 16.18.3

Timeline

  • 2026-05-18: patched: Fixes merged into version 15 and 16 hotfix branches
  • 2026-05-20: advisory: Release notes for 15.108.0 and 16.18.3 published
  • 2026-07-10: disclosed: CVE-2026-47199 published to NVD

References

Related threats