CVE-2026-109652
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.
Risk Assessment
An attacker can access and modify data, delete documents, and use the server for outbound actions, potentially leading to serious security breaches.
Recommendation
Upgrade ERPNext to version 15.119.1 or 16.32.0 (or later) and verify that message fields are properly validated before template rendering.
Other vulnerabilities in Frappe ERPNext
See all- CVE-2026-109674Medium
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation.
- CVE-2026-109673High
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers.
- CVE-2026-109672Medium
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks.
- CVE-2026-109671High
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages.
- CVE-2026-109670Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping.
- CVE-2026-109669Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes.
- CVE-2026-109668Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role.
- CVE-2026-109667High
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts.
- CVE-2026-109666Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records.
- CVE-2026-109665Medium
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.
Original NVD description (English source)
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS