SQL Injection Vulnerability in Frappe Framework
CVE-2026-47199

2.3LOW

Key Information:

Vendor

Frappe

Status
Frappe
Vendor
CVE Published:
10 July 2026

What is CVE-2026-47199?

The Frappe Framework, a robust web application framework, has a security flaw that allows for SQL injection through improperly secured SELECT INTO OUTFILE queries. This vulnerability may be exploited on self-hosted installations if database permissions are not adequately configured and MySQL FILE privileges are granted. Users are strongly advised to upgrade to versions 16.18.3 or 15.108.0, where this security issue has been addressed.

Affected Version(s)

frappe < 15.108.0 < 15.108.0

frappe >= 16.0.0-beta.1, < 16.18.3 < 16.0.0-beta.1, 16.18.3

References

https://github.com/frappe/frappe/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/39345
x_refsource_MISC
https://github.com/frappe/frappe/pull/39346
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.