CVE-2026-65822
Received Received - Intake

SQL Injection in ERPNext Selling Report

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-65822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
erpnext erpnext to 16.23.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in ERPNext, an open-source Enterprise Resource Planning tool. It allows authenticated users to inject unvalidated doctype filters into raw SQL queries through the inactive_customers.py file. This can lead to unauthorized extraction of sensitive data and manipulation of database queries.

Detection Guidance

Check ERPNext version with: bench version. If version is below 15.116.0 or 16.23.0, the system is vulnerable. Review logs for suspicious SQL queries in erpnext/selling/report/inactive_customers/inactive_customers.py.

Impact Analysis

An attacker with access could steal sensitive information from the database or alter queries to manipulate data. This could lead to data breaches, financial loss, or unauthorized changes to business records. The impact depends on the data stored in the ERP system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for health information. A breach could result in legal penalties or fines.

Mitigation Strategies

Upgrade ERPNext to version 15.116.0 or 16.23.0 immediately. Restrict database access for authenticated users. Monitor database queries for unauthorized activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65822. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart