Executive brief
ERPNext, a popular open-source enterprise resource planning (ERP) suite, is vulnerable to a security flaw in its email template system. An attacker who can create or edit email templates can execute malicious code on the server. This could lead to the theft of sensitive business data, unauthorized access to the database, or a complete takeover of the ERP system.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe/ERPNext email template engine. The root cause is improper sanitization of template expressions within the email message body, which are processed by the server-side rendering engine. An attacker with permissions to create or modify email templates can inject Jinja-style expressions (e.g., using frappe.db.sql) to execute arbitrary database queries or system commands. While the CVSS vector suggests no privileges are required, the exploit typically requires access to the 'Email Template' desk component. Successful exploitation allows for full data exfiltration from the 'tabUser' table and potentially broader server compromise.
Affected products
- Frappe ERPNext <= 15.103.1
Timeline
- 2026-04-03: disclosed: Initial researcher disclosure
- 2026-05-05: advisory: CVE published to NVD