CVE-2026-31877: Frappe SQL Injection due to improper field sanitization
Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31877?
CVE-2026-31877 is categorized as a medium to high severity vulnerability due to the potential for SQL injection.
How do I fix CVE-2026-31877?
To fix CVE-2026-31877, upgrade Frappe to version 15.84.0 or 14.99.0 or later.
Which versions of Frappe are affected by CVE-2026-31877?
Frappe versions prior to 15.84.0 and 14.99.0 are affected by CVE-2026-31877.
What type of attack does CVE-2026-31877 enable?
CVE-2026-31877 enables SQL injection attacks, allowing unauthorized information access from the database.
Why is it important to address CVE-2026-31877 promptly?
Addressing CVE-2026-31877 promptly is important because it can lead to significant data breaches and compromise the integrity of databases.