CVE-2026-47199: Frappe Framework SQL Injection Vulnerability

CVE-2026-47199 Overview

CVE-2026-47199 affects Frappe, a full-stack web application framework used to build business applications including ERPNext. The check_safe_sql_query function permitted SELECT INTO OUTFILE queries to pass its safety validation. On self-hosted deployments where MySQL FILE privileges are granted to the database user, an authenticated attacker could write query results to arbitrary files on the database server filesystem. The issue is a SQL injection weakness [CWE-89] resolved in Frappe versions 16.18.3 and 15.108.0.

Critical Impact
Authenticated users on self-hosted Frappe instances with misaligned MySQL permissions could abuse SELECT INTO OUTFILE to write attacker-controlled data to the database server filesystem.

Affected Products

Frappe versions prior to 15.108.0 (v15 branch)
Frappe versions prior to 16.18.3 (v16 branch)
Self-hosted Frappe deployments where MySQL FILE privilege is granted

Discovery Timeline

2026-07-10 - CVE-2026-47199 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-47199

Vulnerability Analysis

Frappe exposes a restricted SQL execution path that relies on check_safe_sql_query in frappe/utils/safe_exec.py to filter queries submitted through report builders and script contexts. The function is intended to permit only read-only SELECT statements. However, its pattern matching did not reject queries containing SELECT ... INTO OUTFILE clauses.

MySQL's SELECT INTO OUTFILE syntax writes query results to a file on the database server host. When the database account used by Frappe holds the FILE privilege, an authenticated user permitted to run reports can convert a benign read query into an arbitrary file write. This bypasses the intent of the safe-query allowlist and undermines the boundary between application-layer read access and filesystem-layer write access on the database host.

Root Cause

The root cause is incomplete input validation in check_safe_sql_query. The allowlist logic verified the leading SQL verb but did not inspect the query body for INTO OUTFILE or INTO DUMPFILE clauses. Frappe managed cloud sites are not affected because database privileges are hardened. Self-hosted operators who granted broad MySQL privileges to the Frappe service account remained exposed.

Attack Vector

Exploitation requires network access to a Frappe site and authenticated access with permission to submit custom SQL through reports or scripting interfaces. The attacker crafts a SELECT statement that appends an INTO OUTFILE '/path/to/file' clause. If the database user has the FILE privilege and the target directory is writable by the MySQL process, the file is created with attacker-controlled contents.

python

def check_safe_sql_query(query: str, throw: bool = True) -> bool:
	import re

	"""Check if SQL query is safe for running in restricted context.

	Safe queries:

Source: Frappe commit 628e103. The patch imports re and extends the validator to reject queries containing INTO OUTFILE and INTO DUMPFILE patterns.

Detection Methods for CVE-2026-47199

Indicators of Compromise

Unexpected files created in directories writable by the MySQL server process (for example, /var/lib/mysql-files/ or /tmp/) with timestamps matching Frappe report execution.
MySQL general query log or audit log entries showing SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE originating from the Frappe application account.
Frappe error logs referencing check_safe_sql_query rejections after upgrading to 15.108.0 or 16.18.3.

Detection Strategies

Enable MySQL audit logging and alert on any statement containing INTO OUTFILE or INTO DUMPFILE from application service accounts.
Review Frappe report submissions and custom script logs for SELECT statements that include file output clauses.
Correlate database query telemetry with filesystem change events on the database host to identify unauthorized writes.

Monitoring Recommendations

Forward MySQL query logs and Frappe application logs to a centralized log platform for retention and correlation.
Baseline the set of report queries executed by legitimate users and alert on deviations that include DDL or file-output syntax.
Monitor the MySQL secure_file_priv setting and privilege grants for the Frappe database user.

How to Mitigate CVE-2026-47199

Immediate Actions Required

Upgrade Frappe to version 15.108.0 or 16.18.3, referenced in GitHub Release v15.108.0 and GitHub Release v16.18.3.
Revoke the MySQL FILE privilege from the database account used by Frappe unless explicitly required.
Set the MySQL secure_file_priv variable to an empty value or a tightly restricted directory to block arbitrary file writes.
Audit report and script permissions in Frappe and remove SQL execution rights from non-administrative roles.

Patch Information

The fix is delivered in commits 628e103 and 91d3ded, landed via pull request #39345 and pull request #39346. Full details are in GitHub Security Advisory GHSA-wx8j-cw4r-vrhv.

Workarounds

Remove the FILE privilege from the Frappe MySQL user until the upgrade can be applied.
Restrict secure_file_priv in the MySQL configuration to prevent INTO OUTFILE writes.
Limit user roles that can submit custom SQL through report builders to trusted administrators.

bash

# Revoke FILE privilege and restrict outfile writes in MySQL
REVOKE FILE ON *.* FROM 'frappe'@'localhost';
FLUSH PRIVILEGES;

# In /etc/mysql/my.cnf under [mysqld], then restart mysql
secure_file_priv = ""