CVE-2026-38431
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
ERPNext v15.103.1 and earlier is vulnerable to Server-Side Template Injection (SSTI). Users with permission to create or edit email templates can inject template expressions executed on the server during rendering.
Risk Assessment
An attacker with appropriate privileges can achieve remote code execution on the server, leading to full compromise of the ERPNext system and data.
Recommendation
Upgrade ERPNext to a version newer than 15.103.1. Restrict email template creation and editing permissions to trusted users only.
Original NVD description (English source)
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.