Server-Side Template Injection in Frappe ERPNext

CVE-2025-66435

What is CVE-2025-66435?

An SSTI vulnerability in Frappe ERPNext allows authenticated users to inject malicious Jinja expressions into contract templates, leading to possible execution of arbitrary code within the server environment. This occurs through the get_contract_template method, which improperly exposes dangerous globals, including database manipulation functions, even within a supposedly sandboxed context. Attackers with permission to modify contract templates can exploit this vulnerability to execute code, potentially leaking sensitive database information.

References