Executive brief
ERPNext is an open-source platform used by businesses to manage operations like accounting, inventory, and payroll. A security flaw in its Electronic Data Interchange (EDI) module allows a logged-in user to access files they should not be able to see. This could lead to the exposure of sensitive system configuration files and other private data stored on the server.
Technical details
An XML External Entity (XXE) vulnerability exists in the EDI Module of ERPNext due to improper restriction of XML external entity references (CWE-611). An authenticated attacker with network access can submit a specially crafted XML document to the affected module. If processed, the application will resolve external entities, allowing the attacker to retrieve the contents of local files, such as configuration files, from the server's file system. The issue is resolved in versions 15.104.3 and 16.12.0.
Affected products
- Frappe ERPNext < 15.104.3, < 16.12.0
Timeline
- 2026-04-30: advisory: Vendor advisory published on GitHub
- 2026-05-13: disclosed: CVE published to NVD dataset