CVE-2026-41581
Deferred Deferred - Pending Action

SQL Injection in Frappe Framework

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in versions 15.106.0 and 16.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-07-02
AI Q&A
2026-06-12
EPSS Evaluated
2026-07-01
NVD
CVE-2026-41581
EUVD
EUVD-2026-36453

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe frappe_framework to 15.106.0 (exc)
frappe frappe_blog to 16.16.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-41581 is a possible SQL injection vulnerability found in the get_blog_list function of the Frappe Framework and Frappe Blog.

This vulnerability affects versions of Frappe Framework prior to 15.106.0 and Frappe Blog versions before 16.16.0.

An attacker could exploit this issue by injecting malicious SQL code through the get_blog_list function, potentially manipulating the database queries executed by the application.

The issue has been patched in versions 15.106.0 and 16.16.0.

Impact Analysis

This SQL injection vulnerability can allow an attacker to manipulate database queries, which may lead to unauthorized access to or modification of data.

Potential impacts include data leakage, data corruption, or unauthorized data manipulation within applications using vulnerable versions of the Frappe Framework or Frappe Blog.

Since the vulnerability is remotely exploitable without authentication, it increases the risk of compromise if the affected software is exposed to untrusted users.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Frappe Framework to version 15.106.0 or later, and the Frappe Blog to version 16.16.0 or later.

No workarounds are available, so applying the official patches by upgrading is the only effective mitigation.

Detection Guidance

There are no specific detection commands or methods provided for identifying this SQL injection vulnerability in the get_blog_list function of the Frappe Framework or Frappe Blog.

The recommended action is to verify the version of the Frappe Framework and Frappe Blog installed on your system and ensure they are updated to versions 15.106.0 or later for the framework, and 16.16.0 or later for the blog, as these versions contain the patch for this vulnerability.

No workarounds or detection commands are mentioned in the advisory.

Compliance Impact

The provided information does not specify how the SQL injection vulnerability in Frappe Framework and Frappe Blog affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart