CVE-2026-12895

Name of the Vulnerable Software and Affected Versions ERPNext version 15.107.0 Frappe version 15.107.2

Description An issue exists where the application constructs SQL queries using direct string interpolation via str.format() instead of parameterized queries. This allows the docname of a Supplier record containing SQL metacharacters to be interpreted as part of the query. An authenticated user with low privileges could exploit this to execute arbitrary SQL queries, bypass DocPerm access restrictions, and extract confidential data, including administrator password hash fragments, credentials, integration tokens, or financial information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.