CVE-2026-54524: Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report

Q: Who can exploit this issue?

An authenticated user assigned the HR User role can exploit the vulnerable report filters. The issue affects Frappe HR deployments prior to version 16.7.0.

Q: What could an attacker obtain through exploitation?

The SQL injection can be used to extract arbitrary data from the database.

Q: What should organizations do to remediate the issue?

Upgrade Frappe HR to version 16.7.0, which fixes the vulnerability.

Published Sep 17, 2026

Updated

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salarypaymentsbasedonpaymentmode/salarypaymentsbasedonpaymentmode.py, getconditions constructs filter clauses from user-controlled values and getdata incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.

Affected Software

1 affected component

Frappe HR<16.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade frappe/hrms to a version that resolves this vulnerability.
Fixed in 16.7.0

Event History

Sep 17, 2026

CVE Published

via MITRE·06:33 PM

Data Sourced

via MITRE·06:33 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user assigned the HR User role can exploit the vulnerable report filters. The issue affects Frappe HR deployments prior to version 16.7.0.

What could an attacker obtain through exploitation?