Server-Side Template Injection in Frappe ERPNext Application

CVE-2025-66434

What is CVE-2025-66434?

A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext application, specifically within the get_dunning_letter_text method. This flaw permits authenticated attackers to leverage attacker-controlled Jinja2 templates rendered by frappe.render_template() using a user-defined context. Despite the use of a custom SandboxedEnvironment, sensitive globals like frappe.db.sql remain accessible, enabling potential malicious actions. An attacker with the right access can craft arbitrary Jinja expressions within the Dunning Type configurations, leading to unauthorized server-side code execution and potential exposure of sensitive database information.

References