CVE-2026-29081

Description

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-05 | Updated 2026-03-05 | Assigner GitHub_M

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

References

github.com/...frappe/security/advisories/GHSA-w3g7-m7xr-2w38

cve.org (CVE-2026-29081)

nvd.nist.gov (CVE-2026-29081)

Download JSON