Frappe ERPNext server-side template injection lets authenticated users read and alter data (CVE-2026-109652)

What happened

Frappe ERPNext does not validate user-controlled message fields before template rendering. An authenticated attacker with a common operational role can submit template expressions that run in an unrestricted context. The CVSS 4.0 vector rates this high with a score of 8.7, requiring low privileges and no user interaction over the network. An attacker who can reach the application can read and write arbitrary database data, delete documents, cause the server to send outbound requests, and send mail from the site. The CVE record does not report active exploitation or public disclosure.

Who is affected

ERPNext releases before 15.119.1 are affected. The 16.x line is affected from 16.0.0-beta.1 up to but not including 16.32.0. The flaw is reachable by authenticated users holding a common operational role, not only by highly privileged administrators.

What to do now

1. Upgrade to ERPNext 15.119.1 if you run a 15.x release, or ERPNext 16.32.0 if you run a 16.x release. The fixed releases are available.
2. Until the upgrade is complete, restrict access to the ERPNext application to trusted internal networks and users where possible.
3. No vendor workaround is listed for this flaw. Review outbound mail volume, outbound server requests and unexpected document deletions for signs of misuse after patching.

How to detect it

There are no published indicators of compromise for this flaw. Watch for unexpected outbound requests from the ERPNext server, unusual outbound mail from the site, and deletions or changes to documents that do not match normal business activity.

Beyond the patch

This flaw is a reminder that the ERP system you depend on is also a supplier dependency. Supply Chain Defense & Third-Party Risk tracks which vendors’ software you run and how their patch cycles set your exposure window, so the next critical update does not catch you by surprise.