High · published December 2, 2025
⚡ A misstep in parameter validation could let attackers read sensitive data directly from your database — all the way down to the version number! Think of it like a restaurant that publishes its secret recipe book online without checking who gets access — anyone can simply request it and see everything that's inside. This SQL injection flaw in Frappe exposes critical information just by manipulating a single endpoint. An attacker could exploit this vulnerability to gain unauthorized insights into the application's database, revealing sensitive details such as the framework version. This could lead to further attacks as the specifics of the application become available, making it a dangerous chink in your security armor.
Think of it like a restaurant that publishes its secret recipe book online without checking who gets access — anyone can simply request it and see everything that's inside. This SQL injection flaw in Frappe exposes critical information just by manipulating a single endpoint. CVE-2025-66205 is an error-based SQL injection vulnerability found in Frappe, where insufficient validation of input parameters enables an attacker to manipulate database queries and extract version information.
An attacker could exploit this vulnerability to gain unauthorized insights into the application's database, revealing sensitive details such as the framework version. This could lead to further attacks as the specifics of the application become available, making it a dangerous chink in your security armor. Update your Frappe installation to versions 15.86.0 or 14.99.2 to patch this vulnerability immediately. Additionally, review input validation practices to ensure robust security against similar attacks in the future. You've got this! 💪 Fixing this is straightforward, and with these steps, your application will be much more secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| frappe/frappe | < 14.99.2 | 14.99.2 |
| frappe/frappe | ≥ 15.0.0, < 15.86.0 | 15.86.0 |