CVE-2024-24813: Frappe SQL Injection from reporting logic

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-21 · updated 2026-06-17
Weakness: CWE-89

Description

Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workarounds are available.

Affected products

frappe: before 14.64.0 — fixed in 14.64.0

How to fix

Upgrade to a fixed version: frappe 14.64.0. Check the vendor advisory for mitigations.

References

https://github.com/frappe/frappe/security/advisories/GHSA-fxfv-7gwx-54jh
https://github.com/frappe/frappe/security/advisories/GHSA-fxfv-7gwx-54jh

Get alerted when CVE-2024-24813 or the next vulnerability affects your stack