CVE-2026-12895 in ERPNext
Summary
by MITRE • 07/29/2026
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability represents a critical sql injection flaw in frappe's erpnext platform affecting versions 15.107.0 and 15.107.2 respectively. The issue stems from improper query construction practices where the application relies on string interpolation via str.format() method instead of implementing proper parameterized queries or prepared statements. when processing supplier records, the system directly incorporates user-supplied docname values into sql command strings without adequate sanitization or escaping mechanisms. this design flaw creates an exploitable condition where authenticated users can manipulate the input parameters to inject malicious sql code that gets executed within the database context.
the technical exploitation of this vulnerability occurs through carefully crafted supplier record names containing sql metacharacters such as single quotes, semicolons, or comment markers. when these malformed identifiers are processed by the application's query builder, the sql injection payload gets embedded directly into the generated sql statements. since the application does not employ proper input validation or output encoding before query construction, the injected sql code bypasses frappe's built-in access control mechanisms known as docperm restrictions. this allows attackers to execute arbitrary database operations that would normally be restricted based on user privileges.
the operational impact of this vulnerability extends beyond simple data extraction to encompass complete database compromise scenarios. authenticated users with minimal privileges can leverage this weakness to access sensitive information including administrator password hash fragments, which represents a significant security risk for credential recovery attacks. additionally the vulnerability enables access to integration tokens that could provide unauthorized access to external systems and services connected to erpnext. financial data, user credentials, and other confidential business information stored within the database becomes vulnerable to exfiltration through this exploitation vector.
this vulnerability aligns with common weakness enumeration cwes 89 and 770, specifically addressing sql injection flaws and improper limitation of a pathname to a restricted directory respectively. from the attack framework perspective it maps to multiple techniques within the attack tactic of privilege escalation and credential access. the attack chain typically involves initial authentication followed by exploitation of the sql injection mechanism to bypass access controls and extract sensitive data elements. mitigation strategies should include immediate implementation of parameterized queries throughout the codebase, regular input validation and sanitization routines, and enhanced access control mechanisms that do not rely solely on application-level query construction. organizations should also implement database activity monitoring and establish proper code review processes to prevent similar issues in future development cycles.
the affected environment represents a typical enterprise resource planning system where unauthorized access to financial data, user credentials, and integration tokens could result in significant business disruption, regulatory compliance violations, and potential financial losses. the vulnerability demonstrates the critical importance of secure coding practices and proper database interaction methodologies in enterprise applications. organizations should prioritize immediate patching of affected versions and conduct comprehensive security assessments of their erpnext installations to identify similar patterns of insecure sql query construction that may exist elsewhere within their codebase.