CVE-2026-55823: Frappe: Possibility of SQL injection in reportview
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 16.23.0
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe deployments running versions prior to 16.23.0 are affected. Version 16.23.0 contains the fix.
What does an attacker need to exploit this issue?
The issue requires crafted report input that reaches the reportview get_count() method. That input can alter SQL executed through the application's raw database execution path.
What should teams do to remediate the issue?
Upgrade Frappe to version 16.23.0. The provided data does not describe a workaround for deployments that cannot be patched immediately.