Executive brief
ERPNext is an open-source Enterprise Resource Planning (ERP) system used to manage business processes like inventory, payroll, and accounting. A security vulnerability allows a standard user to gain unauthorized access to sensitive data by injecting malicious code into configuration fields. This could lead to a full system compromise or the exposure of confidential business information beyond the user's assigned permissions.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in ERPNext due to improper neutralization of special elements within template engine inputs (CWE-1336). An authenticated attacker with low-level operational privileges can input malicious template expressions into specific configuration fields. When the server processes these fields, the template engine executes the injected code, potentially leading to a scope change (S:C) and full compromise of confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-55242 and is fixed in versions 15.111.0 and 16.22.0. The attack vector is classified as local, implying the attacker must already have access to the system's interface.
Affected products
- Frappe ERPNext < 15.111.0, >= 16.0.0 < 16.22.0
Timeline
- 2026-07-04: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date