CVE-2026-72908
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
ERPNext prior to versions 15.109.0 and 16.20.0 has an SQL injection vulnerability in the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py, which constructs an SQL WHERE clause from request-influenced posting_date and args values. An authenticated low-privilege user can inject SQL and extract sensitive information.
Risk Assessment
Risk of leakage of confidential data from the database, which could compromise the privacy and integrity of organizational data.
Recommendation
Upgrade ERPNext to version 15.109.0 or 16.20.0 where this vulnerability is fixed. Restrict user privileges and monitor SQL queries.
Original NVD description (English source)
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.