PatchSiren cyber security CVE debrief

CVE-2026-41581 frappe CVE debrief

CVE-2026-41581 is a SQL Injection vulnerability in Frappe, a full-stack web application framework. The vulnerability is located in the `get_blog_list` function and has been patched in versions 15.106.0 and 16.16.0. The CVSS score for this vulnerability is 6.9, indicating a medium severity.

Vendor: frappe
Product: Unknown
CVSS: MEDIUM 6.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-12
Original CVE updated: 2026-06-12
Advisory published: 2026-06-12
Advisory updated: 2026-06-12

Who should care

Users of Frappe framework versions prior to 15.106.0 and 16.16.0 should apply the patches to prevent SQL Injection attacks.

Technical summary

The vulnerability is caused by a lack of proper input sanitization in the `get_blog_list` function, allowing an attacker to inject malicious SQL code. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium

Recommended defensive actions

Apply patches in versions 15.106.0 and 16.16.0 or later.
Review and update Frappe framework to the latest version.

Evidence notes

CVE-2026-41581 was published on 2026-06-12T15:16:25.723Z and modified on 2026-06-12T15:56:54.563Z.

Official resources

CVE-2026-41581 was disclosed by Frappe framework maintainers via a security advisory on GitHub [ref-4].