SQL Injection Vulnerability in ERPNext by Frappe

CVE-2026-12895

What is CVE-2026-12895?

A vulnerability in ERPNext, specifically in versions 15.107.0 and Frappe 15.107.2, allows for SQL injection due to the use of direct string interpolation in SQL query construction. This flaw can be exploited by authenticated users with low privileges, enabling them to execute arbitrary SQL queries. By manipulating the name (docname) of a Supplier record, attackers may bypass access controls, leading to unauthorized access to sensitive information stored in the database, including credentials, integration tokens, and fragments of the administrator’s password hash. Organizations using affected versions should apply patches promptly to mitigate the risk.

References