CVE-2026-114664: Frappe before 16.33.0 Blind SQL Injection via get_events
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer query results from application behavior to extract sensitive database information.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe Framework deployments running versions before 16.33.0 are affected if authenticated users can reach the get_events method.
What access does an attacker need?
An attacker needs an authenticated account and the ability to submit crafted input to get_events. No user interaction is required.
What can an attacker gain through exploitation?
The blind SQL injection can allow an authenticated attacker to infer database query results from application behavior and extract sensitive database information.
What is the remediation?
Upgrade Frappe Framework to version 16.33.0 or later.