Server-Side Template Injection in Frappe ERPNext Application
CVE-2025-66434

8.8HIGH

Key Information:

Vendor

Frappe

Status
ERPNext
Vendor
CVE Published:
15 December 2025

What is CVE-2025-66434?

A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext application, specifically within the get_dunning_letter_text method. This flaw permits authenticated attackers to leverage attacker-controlled Jinja2 templates rendered by frappe.render_template() using a user-defined context. Despite the use of a custom SandboxedEnvironment, sensitive globals like frappe.db.sql remain accessible, enabling potential malicious actions. An attacker with the right access can craft arbitrary Jinja expressions within the Dunning Type configurations, leading to unauthorized server-side code execution and potential exposure of sensitive database information.

References

https://www.notion.so/SSTI-bug-1-239e6086eadc8096bfcfe905...
https://iamanc.github.io/post/erpnext-ssti-bug-1

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.