CVE-2026-109647: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in frappe erpnext

Frappe ERPNext versions prior to 15.106.0 and 16.x prior to 16.16.0 contain an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. Authenticated attackers with low privileges can exploit this by sending specially crafted requests to multiple endpoints, enabling them to manipulate database queries and potentially extract sensitive data from the ERPNext database. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Successful exploitation allows authenticated attackers to manipulate SQL queries, leading to unauthorized disclosure of sensitive information stored in the ERPNext database. The vulnerability does not require elevated privileges beyond authentication and does not impact integrity or availability according to the CVSS vector. There are no known exploits in the wild at this time.

A fix is available in ERPNext versions 15.106.0 and 16.16.0 and later. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, manual patching or upgrading is required. Patch status is confirmed by the affected version ranges indicating fixed versions. No vendor advisory content was provided, so check the official ERPNext release notes or security advisories for detailed patch instructions.