CVE-2025-58439 is a high severity (CVSS 8.1) error-based SQL injection in ERPNext, the open source ERP from Frappe. Missing parameter validation affected certain endpoints. Versions below 14.89.2 and from 15.0.0 through 15.75.1 are affected. The fixes are 14.89.2 and 15.76.0.
What's affected
ERPNext below 14.89.2, per the record and the GitHub advisory. Fixed in 14.89.2.
ERPNext 15.0.0 through 15.75.1. Fixed in 15.76.0.
The record says the leak includes details such as the database version, and the CVSS vector lists low privileges required, so an account is needed.
How to check if you're exposed
On a bench based installation, list the installed app versions.
bench version
bench --site your-site.example list-apps
Compare the ERPNext line against the fixed versions above. For container deployments, check the image tag. Review which users hold accounts on the site and whether any are shared or stale.
What to do now
- Run bench version on every site and note the ERPNext version.
- Upgrade to 14.89.2 on the 14 line or 15.76.0 on the 15 line, following the Frappe update procedure and after a backup.
- Review user accounts and remove stale ones, since exploitation needs a logged in user.
- Watch database and application error logs for repeated SQL errors, which can indicate probing.
- Run the application's database account with only the privileges it needs, and keep it away from other schemas.
- Log and alert on database errors coming from the web tier, since probing often shows up as a burst of malformed requests.
Why it matters
Error-based SQL injection works by making the database report errors that contain data. The application failed to validate parameters on certain endpoints before using them in a query, so a crafted value could change the query and cause informative errors.
Because an ERP holds financial records, customer and supplier data and employee details, even a limited disclosure is serious. The fix in both release lines validates the input the endpoints receive.
The record classifies the weakness as CWE-89 (SQL Injection).
SQL injection happens when text from a request is placed into a database query as if it were part of the query itself. The database cannot tell the developer's instructions from the visitor's input, so a crafted value can change what the query does. The standard fix is a parameterized query, where the values travel separately from the statement.
For defenders the useful question is what the database account behind the application is allowed to do. A web user with read and write access to every table turns one flawed parameter into a full data exposure. A narrow account limits the damage while the code is being corrected.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix CVE-2025-58439?
14.89.2 for the 14 line and 15.76.0 for the 15 line.
Does an attacker need an account?
The CVSS vector lists low privileges required, so a logged in user is needed, but ERP systems often have many users.
Sources
Last reviewed: 18 October 2026.
