Frappe Framework: Blind SQL injection (CVE-2026-114664)
Frappe Framework versions prior to 16.33.0 contain a blind SQL injection vulnerability in the get_events method, allowing authenticated attackers to extract sensitive database content.
CVE search metadata
CVE search record: CVE-2026-114664. Severity: high. CVSS: 7.1. KEV: no. Product: Frappe Framework (< 16.33.0). Brief: Frappe Framework: Blind SQL injection (CVE-2026-114664). Brief link: https://feed.craftedsignal.io/briefs/2026-10-frappe-sqli/
Triage facts
Revision 1- Applicability
- Frappe Framework (< 16.33.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 03:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method. The vulnerability arises from the failure to properly neutralize user-supplied input before it is included in SQL queries. An authenticated attacker can send crafted input to the affected method and infer query results based on the application's response, leading to the unauthorized exfiltration of database contents.
Impact
Successful exploitation allows an authenticated attacker to perform blind SQL injection, which can lead to the unauthorized extraction of sensitive data from the underlying database.
Recommendation
- Upgrade the Frappe Framework to version 16.33.0 or later to remediate this vulnerability.
- Review web server access logs for anomalous requests targeting the 'frappe.desk.doctype.event.event.get_events' endpoint.
- Implement strict input validation and parameterized queries for all database interaction methods if upgrading is not immediately possible.
Immediate actions
Upgrade Frappe Framework to version 16.33.0 or later.
Mitigations
Upgrade Frappe Framework to 16.33.0
CVE-2026-114664