CVE-2026-12895 Overview
CVE-2026-12895 is a SQL injection vulnerability [CWE-89] affecting Frappe's ERPNext platform. The flaw exists in ERPNext version 15.107.0 and Frappe version 15.107.2. The application constructs SQL queries through direct string interpolation using Python's str.format() method instead of parameterized queries. An authenticated user with low privileges can inject SQL metacharacters through the name (docname) field of a Supplier record. Successful exploitation bypasses Frappe's DocPerm access restrictions and enables extraction of confidential database contents, including administrator password hash fragments, credentials, integration tokens, and financial data.
Critical Impact
An authenticated low-privileged attacker can execute arbitrary SQL queries and exfiltrate sensitive database contents, including administrator password hash fragments.
Affected Products
- Frappe ERPNext version 15.107.0
- Frappe Framework version 15.107.2
- Deployments exposing the Supplier DocType to authenticated users
Discovery Timeline
- 2026-07-29 - CVE-2026-12895 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-12895
Vulnerability Analysis
The vulnerability resides in server-side query construction logic within ERPNext's Supplier record handling. The application interpolates the docname value directly into a SQL statement using Python str.format() calls. This pattern bypasses the database driver's parameter binding and treats attacker-controlled characters as SQL syntax. Because the exploited path executes under an authenticated Frappe session, standard authentication controls do not block the attack. The DocPerm authorization layer, which normally restricts data access per role, is also bypassed because injected SQL runs directly against the underlying MariaDB or PostgreSQL backend.
Root Cause
The root cause is unsafe SQL query construction via Python string formatting rather than parameterized queries. The Supplier record's name field accepts user-supplied values that reach the database layer without sanitization or escaping. Frappe's ORM supports parameterized frappe.db.sql() calls, but the affected code paths use str.format() to build the query string.
Attack Vector
Exploitation requires network access to an ERPNext instance and valid low-privilege credentials. The attacker submits a crafted Supplier docname value containing SQL metacharacters through the standard web application interface. The injected payload executes with the database privileges of the ERPNext application user. Attackers can enumerate table schemas, extract user credential hashes character by character using conditional or time-based techniques, and read integration secrets stored in Frappe's document store.
No public exploit code is available at the time of publication. Technical details are documented in the INCIBE CERT Security Notice.
Detection Methods for CVE-2026-12895
Indicators of Compromise
- Unusual Supplier record names containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment markers (--, #)
- Frappe application logs showing malformed queries or database errors originating from Supplier document operations
- Unexpected read access to tabUser, tabAuth, or credential-storage tables from the ERPNext service account
- Long-running database queries or repeated boolean-style requests from a single authenticated session
Detection Strategies
- Enable MariaDB or PostgreSQL general query logging and alert on statements containing suspicious string patterns against Frappe tables
- Inspect Frappe request logs for POST and PUT operations against Supplier endpoints where the name parameter contains non-alphanumeric characters
- Correlate authenticated low-privilege user sessions with database queries that touch privileged tables such as tabUser or tabOAuth Bearer Token
Monitoring Recommendations
- Deploy a web application firewall rule set to flag SQL injection payloads targeting /api/method/frappe.client.* and Supplier endpoints
- Baseline normal query volume per authenticated user and alert on statistical outliers
- Forward Frappe application logs and database audit logs to a centralized SIEM for retention and correlation
How to Mitigate CVE-2026-12895
Immediate Actions Required
- Upgrade Frappe and ERPNext to a fixed release once published by the Frappe project
- Audit all Supplier records for docnames containing SQL metacharacters and investigate their origin
- Rotate administrator passwords, API keys, and integration tokens that may have been exposed
- Restrict Supplier DocType write permissions to trusted roles until patching is complete
Patch Information
Refer to the INCIBE CERT Security Notice for vendor coordination details. Monitor the Frappe and ERPNext GitHub repositories for security releases superseding versions 15.107.0 (ERPNext) and 15.107.2 (Frappe).
Workarounds
- Restrict network access to the ERPNext instance to trusted users through VPN or IP allowlists
- Reduce the number of accounts with Supplier create or write permissions to the minimum necessary
- Deploy WAF signatures to block SQL metacharacters in request parameters targeting Frappe REST and RPC endpoints
- Increase database audit logging verbosity and review logs for anomalous Supplier-related queries
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
