CVE-2026-109652

Published: Ott 13, 2026 Last Modified: Ott 13, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

1336

Improper Neutralization of Special Elements Used in a Template Engine

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
Languages: Java, PHP, Python, JavaScript, Interpreted
Technologies: Not Technology-Specific, AI/ML, Client Server
View CWE Details
https://github.com/frappe/erpnext/security/advisories/GHSA-…
https://github.com/frappe/erpnext/security/advisories/GHSA-6w83-8777-v93q
https://www.vulncheck.com/advisories/frappe-erpnext-before-…
https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-server-side…