CVE-2026-72908: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in frappe erpnext
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.
AI Analysis
Technical Summary
ERPNext versions before 15.109.0 and 16.20.0 contain an SQL Injection vulnerability (CWE-89) in the get_tax_template function. This function builds an SQL WHERE clause from request-influenced parameters posting_date and args without proper neutralization of special SQL elements. As a result, an authenticated user with low privileges can inject SQL code to extract sensitive data. The vulnerability is resolved in ERPNext versions 15.109.0 and 16.20.0.
Potential Impact
An authenticated low-privilege user can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality.
Mitigation Recommendations
Upgrade ERPNext to version 15.109.0 or later, or 16.20.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Patch status is confirmed by the vendor stating the fix is included in these versions.
CVE-2026-72908: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in frappe erpnext
Description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.
CVSS v3.1
Score 6.5medium
Affected software
frappe
erpnext
pkg:github/frappe/erpnextRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ERPNext versions before 15.109.0 and 16.20.0 contain an SQL Injection vulnerability (CWE-89) in the get_tax_template function. This function builds an SQL WHERE clause from request-influenced parameters posting_date and args without proper neutralization of special SQL elements. As a result, an authenticated user with low privileges can inject SQL code to extract sensitive data. The vulnerability is resolved in ERPNext versions 15.109.0 and 16.20.0.
Potential Impact
An authenticated low-privilege user can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality.
Mitigation Recommendations
Upgrade ERPNext to version 15.109.0 or later, or 16.20.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Patch status is confirmed by the vendor stating the fix is included in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-10T17:57:26.143Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7a3b18bf8831d539856776
Added to database: 08/10/2026, 20:56:56 UTC
Last enriched: 08/10/2026, 21:12:31 UTC
Last updated: 09/24/2026, 01:47:44 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.