CVE-2026-72911

CRITICAL 9.9

ERPNext: Possibility of server-side template injection due to missing validation

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

CWE	CWE-1336
Vendor	frappe
Product	erpnext
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for frappe erpnext

Be the first to know when new critical vulnerabilities affecting frappe erpnext are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

frappe / erpnext

< 15.118.0 >= 16.0.0, < 16.29.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7 github.com: https://github.com/frappe/erpnext/pull/56458 github.com: https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28 github.com: https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39 github.com: https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465 github.com: https://github.com/frappe/erpnext/releases/tag/v15.118.0 github.com: https://github.com/frappe/erpnext/releases/tag/v16.29.0