Server-Side Template Injection in Frappe ERPNext Product

CVE-2025-66438

What is CVE-2025-66438?

A vulnerability exists in Frappe ERPNext's Print Format rendering process, which allows authenticated users with permission to create or modify Print Formats to inject arbitrary Jinja expressions. This occurs through the API functionality that invokes the rendering mechanism. Although the environment is sandboxed, it still exposes critical database access functions. If an attacker crafts a malicious Print Format and saves it, they can execute a privileged render process that discloses sensitive database information, such as schema details and versioning, through crafted payloads.

References