Executive brief
ERPNext is an open-source Enterprise Resource Planning (ERP) platform used by businesses to manage operations like accounting, HR, and inventory. A security flaw in the software allows a logged-in user to bypass file access restrictions and read sensitive files from the server's underlying file system. This could lead to the exposure of confidential business data, configuration files, or system credentials, potentially compromising the entire server.
Technical details
A path traversal vulnerability (CWE-22) exists in ERPNext due to improper neutralization of user-supplied input used to construct file paths. An authenticated attacker with low privileges can exploit a specific endpoint by providing manipulated path sequences (e.g., '../') to access files outside of the intended directory. The attack is carried out over the network and does not require user interaction. Successful exploitation allows the attacker to read arbitrary files on the host operating system that the application process has permissions to access. The issue is resolved in versions 15.101.1 and 16.10.0.
Affected products
- Frappe ERPNext < 15.101.1, < 16.10.0
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published by developer
- 2026-05-13: disclosed: NVD publication date