CVE-2026-12895
Received Received - Intake

SQL Injection in ERPNext via Supplier Docname

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-12895

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe erpnext 15.107.0
frappe frappe 15.107.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in Frappe's ERPNext (versions ERPNext 15.107.0 and Frappe 15.107.2). The application builds SQL queries by directly inserting user input into strings without using safe methods like parameterized queries. An attacker with low privileges could exploit this by crafting a Supplier record name containing SQL special characters to run unauthorized database commands.

Detection Guidance

Detecting this SQL injection vulnerability requires checking for improper SQL query construction in Frappe/ERPNext. Inspect application logs for unusual queries containing docname values with SQL metacharacters. Look for patterns like quotes or semicolons in user-supplied Supplier record names. Enable database query logging to monitor for suspicious queries. Review code for use of str.format() in SQL query construction.

Impact Analysis

An attacker could extract sensitive data like password hashes, credentials, integration tokens, or financial information. They might bypass access restrictions to view or modify restricted data, even with low-level user permissions. This could lead to data breaches, unauthorized transactions, or system compromise.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict controls to prevent unauthorized data access or exposure. A successful exploit could result in data breaches, leading to regulatory penalties, fines, and reputational damage due to non-compliance with security and privacy mandates.

Mitigation Strategies

Immediately upgrade to ERPNext 15.107.1 or later and Frappe 15.107.3 or later. Replace all instances of str.format() in SQL query construction with parameterized queries. Implement input validation for Supplier record names to block SQL metacharacters. Review database access logs for signs of exploitation. Consider revoking low-privilege user access temporarily until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12895. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart