CVE-2026-54524 Details
Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.
A SQL injection vulnerability has been identified in the Salary Payments Based on Payment Mode report of Frappe HR, prior to version 16.7.0. This vulnerability allows authenticated users with the HR User role to inject SQL through filters, potentially leading to the extraction of arbitrary data from the database. The issue arises in the report's Python file, where user-controlled values are used to construct filter clauses that are then incorporated into a string-formatted SQL query.
Users can update to Frappe HR version 16.7.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9 | [email protected] | Source CodeVendor |
| https://github.com/frappe/hrms/pull/4515 | [email protected] | Issue TrackingVendor |
| https://github.com/frappe/hrms/releases/tag/v16.7.0 | [email protected] | Release NotesVendor |
| https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe HR | 16.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | New CVE Received | [email protected] |
| Sep 17, 2026 | CVE Modified | CISA-ADP |