CVE-2026-47199: Frappe Framework SQL injection via SELECT INTO OUTFILE in safe_exec

CVE-2026-47199 · Severity: info · CVSS 2.3 · Published 2026-07-10

Frappe, a web application framework, contained a security flaw where its database query safety checker failed to block commands that export data to files. On self-hosted systems with specific database configurations, a logged-in user could potentially use this to write data to the server's file system. This could lead to unauthorized data exports or local file creation if the database service has excessive permissions.

Technologies: Frappe Technologies Frappe Framework. Vendors: Frappe Technologies.

Quick answers

Is CVE-2026-47199 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47199 being exploited in the wild.
How severe is CVE-2026-47199?
Informational severity, with a CVSS score of 2.3, published 10 July 2026.
Which products and versions are affected?
Frappe Technologies Frappe Framework < 15.108.0, >= 16.0.0-beta.1, < 16.18.3.
Is there a fix for CVE-2026-47199?
A patch was published on 2026-05-18: Fixes merged into version 15 and 16 hotfix branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47199 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47199?
Check whether you run Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the Frappe Framework's 'check_safe_sql_query' utility. Prior to the fix, the function's blacklist did not account for 'SELECT INTO OUTFILE' or 'DUMPFILE' statements, which are used to export query results to the server's local file system. An attacker with low-level privileges (PR:L) could execute these queries in restricted contexts if the underlying MySQL/MariaDB user has the 'FILE' privilege and directory permissions are poorly aligned. The vulnerability is addressed by adding regex-based validation to block these export keywords in 'frappe/utils/safe_exec.py'.

Affected products

  • Frappe Frappe Framework < 15.108.0, >= 16.0.0-beta.1, < 16.18.3

Timeline

  • 2026-05-18: patched: Fixes merged into version 15 and 16 hotfix branches
  • 2026-05-20: advisory: Release notes for 15.108.0 and 16.18.3 published
  • 2026-07-10: disclosed: CVE-2026-47199 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.