CVE-2026-41320: Frappe HR has possibility of SQL Injection due to improper field sanitization
Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41320?
CVE-2026-41320 has a high severity rating due to the potential for SQL injection vulnerabilities that could lead to unauthorized data access.
How do I fix CVE-2026-41320?
To fix CVE-2026-41320, upgrade Frappe HR to version 15.54.0 or 14.38.1 or later to address the SQL injection vulnerabilities.
What versions of Frappe HR are affected by CVE-2026-41320?
Versions of Frappe HR prior to 15.54.0 and 14.38.1 are affected by CVE-2026-41320.
What type of vulnerability is CVE-2026-41320?
CVE-2026-41320 is classified as an SQL Injection vulnerability due to improper field sanitization.
Who is the vendor for the software affected by CVE-2026-41320?
The vendor for the affected software is Frappe.