CVE-2026-109648: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in frappe erpnext

Frappe ERPNext versions prior to 15.106.0 and 16.x prior to 16.16.0 contain an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. Authenticated attackers can exploit this by sending specially crafted requests to vulnerable endpoints, resulting in injection of SQL code into database queries. This can lead to unauthorized disclosure of sensitive data from the underlying database. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Successful exploitation allows an authenticated attacker to inject arbitrary SQL commands, potentially extracting sensitive information from the database. This compromises data confidentiality but does not indicate impact on integrity or availability.

A fix is available in Frappe ERPNext versions 15.106.0 and 16.16.0 and later. Users should upgrade to these versions or later to remediate the vulnerability. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.