SQL Injection in Frappe

CVE-2026-41581

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in versions 15.106.0 and 16.16.0.

Vulnerability class: SQL Injection

EPSS: 0.002 (13.7th percentile) — read the EPSS interpretation.

Affected products

Frappe — versions < 15.106.0, < 16.16.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM)