CVE-2026-47199 — Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE
Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self…
Published: 2026-07-10 · CVSS: 2.3 · CVSS 4.0
Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7