CVE-2026-55796: Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe HRto a version that resolves this vulnerability.Fixed in 15.60.3 - Upgrade
Upgrade
Frappe HRto a version that resolves this vulnerability.Fixed in 16.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated HR user who can supply filter values to the Salary Payments via ECS report can exploit it. The attack is network-accessible and does not require user interaction.
Which deployments are affected?
Frappe HR versions prior to 15.60.3 and 16.7.1 are affected where the Salary Payments via ECS report is available to authenticated HR users.
What is the impact of successful exploitation?
Successful SQL injection can allow access to sensitive database records. The provided data does not indicate integrity or availability impact.
What should teams do to remediate the issue?
Upgrade to Frappe HR version 15.60.3 or 16.7.1. If upgrading cannot occur immediately, restrict access to the Salary Payments via ECS report to only trusted HR users.