CVE-2025-55731: Frappe has the possibility of Authenticated SQL Injection due to improper validations

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-20 · updated 2026-06-17
Weakness: CWE-89

Description

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.

Affected products

frappe: before 14.96.15; from 15.0.0 before 15.74.2 — fixed in 14.96.15, 15.74.2

How to fix

Upgrade to a fixed version: frappe 14.96.15, 15.74.2. Check the vendor advisory for mitigations.

References

https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410
https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd
https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2

Get alerted when CVE-2025-55731 or the next vulnerability affects your stack