Executive brief
ERPNext is an open-source enterprise resource planning (ERP) platform used to manage business processes like accounting, HR, and inventory. A security flaw allows an authenticated user to force the ERP server to make unauthorized web requests to internal or external services. This could allow an attacker to scan internal networks or access sensitive information from other services that are not normally exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in ERPNext due to insufficient validation of user-supplied URLs in a specific endpoint. An authenticated attacker with low privileges can send a crafted request that forces the server to initiate outbound HTTP connections to arbitrary destinations. This can be leveraged to bypass firewalls, perform internal port scanning, or interact with internal metadata services. The vulnerability is tracked as CWE-918 and has been addressed in versions 15.106.0 and 16.16.0.
Affected products
- Frappe ERPNext < 15.106.0, < 16.16.0
Timeline
- 2026-04-30: advisory: Initial advisory published by Frappe on GitHub
- 2026-05-13: disclosed: CVE published to NVD dataset