PT-2026-57315 · Frappe · Frappe

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-47199

Mitre

CVSS v4.0

2.3

Baixa

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check safe sql query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-47199

Produtos afetados

Frappe

Referências · 8

• https://github.com/frappe/frappe/pull/39346 · Nota
• https://github.com/frappe/frappe/releases/tag/v15.108.0 · Nota
• https://github.com/frappe/frappe/security/advisories/GHSA-wx8j-cw4r-vrhv · Nota
• https://github.com/frappe/frappe/releases/tag/v16.18.3 · Nota
• https://github.com/frappe/frappe/pull/39345 · Nota
• https://github.com/frappe/frappe/commit/91d3ded038d1c901b73f4a2293e134d691c1662d · Nota
• https://github.com/frappe/frappe/commit/628e103f7ffe307447d9fc9e2c572cbddedfa3b5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-47199 · Nota de Segurança