CVE-2026-72908

This SQL injection in ERPNext's tax_rule module targets a posting_date parameter that flows directly into a dynamically constructed WHERE clause. If you're running Frappe/ERPNext 15.x or 16.x, this is what matters: First, verify your version. The vulnerability was patched in versions 15.109.0 and 16.20.0. If you're on an earlier 15.x or 16.x release, assume exposure. The vulnerable function builds SQL strings by concatenating request-influenced values rather than using frappe.db.sql with a values dictionary or the ORM's filter conditions. Any authenticated user—regardless of low privilege—can manipulate the posting_date parameter to extract arbitrary data from the database. Second, the CVSS 6.5 score badly undersells this. A low-privilege user pulling financial records from an ERP isn't generic data exposure—it's invoice totals, supplier terms, payment histories, and margin data. The blast radius is the entire financial database if row-level permissions aren't enforced at the query layer, which they typically aren't in this pattern. Parameterization fixes the injection hole but doesn't fix the architectural reality that one vulnerable function can reach the core financial dataset. Third, the dual-branch presence (identical vulnerable code in both 15.x and 16.x) indicates this pattern survived the version fork without security review. That means either the upgrade process copied vulnerable code mechanically, or the same developer repeated the mistake independently. Either way, it signals a gap in how security-sensitive modules are audited during branch management. What to check: search your codebase for patterns like `frappe.db.sql(

Reviewed through automated stages and approved by a human before publication.