CVE-2026-12895
Last modified
CVE-2026-12895 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query.
Description
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Frappe | ERPNext | < 15.111.0; < 16.22.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-12895?
How severe is CVE-2026-12895?
How do I fix CVE-2026-12895?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12879An Improper Input Validation vulnerability in BigQuery DAO i…5.9
- CVE-2026-1288A maliciously crafted RFA file, when converted to FormIt via…5.5
- CVE-2026-12888An HTML injection vulnerability exists in the Google Chat we…2
- CVE-2026-1289A maliciously crafted PDF file, when parsed through Autodesk…7.8
- CVE-2026-12891A flaw was found in the GStreamer gst-plugins-bad package. W…4.3
- CVE-2026-12892A flaw was found in GStreamer's gst-plugins-bad package. Whe…4.4
- CVE-2026-12897Horner Automation Cscape versions prior to 10.2 SP3 are vuln…8.4
- CVE-2026-12898The All-in-One WP Migration and Backup WordPress plugin befo…6.5
- CVE-2026-1290Authentication Bypass by Primary Weakness vulnerability in J…5.3
- CVE-2026-12900The Spectra Gutenberg Blocks – Website Builder for the Block…6.4
- CVE-2026-12901The GetPaid WordPress plugin before 2.8.55 does not verify t…5.9
- CVE-2026-12902The Kadence Blocks — Page Builder Toolkit for Gutenberg Edit…4.3
Are you affected by CVE-2026-12895?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST