CVE-2026-41581
Deferred Deferred - Pending Action
SQL Injection in Frappe Framework

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in versions 15.106.0 and 16.16.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-12
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-41581
EUVD
EUVD-2026-36453
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
frappe frappe_framework to 15.106.0 (exc)
frappe frappe_blog to 16.16.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-41581 is a possible SQL injection vulnerability found in the get_blog_list function of the Frappe Framework and Frappe Blog.

This vulnerability affects versions of Frappe Framework prior to 15.106.0 and Frappe Blog versions before 16.16.0.

An attacker could exploit this issue by injecting malicious SQL code through the get_blog_list function, potentially manipulating the database queries executed by the application.

The issue has been patched in versions 15.106.0 and 16.16.0.

Impact Analysis

This SQL injection vulnerability can allow an attacker to manipulate database queries, which may lead to unauthorized access to or modification of data.

Potential impacts include data leakage, data corruption, or unauthorized data manipulation within applications using vulnerable versions of the Frappe Framework or Frappe Blog.

Since the vulnerability is remotely exploitable without authentication, it increases the risk of compromise if the affected software is exposed to untrusted users.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Frappe Framework to version 15.106.0 or later, and the Frappe Blog to version 16.16.0 or later.

No workarounds are available, so applying the official patches by upgrading is the only effective mitigation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart