Server-Side Template Injection Vulnerability in Frappe ERPNext

CVE-2026-109652

What is CVE-2026-109652?

Frappe ERPNext versions prior to 15.119.1 and 16.x before 16.32.0 are vulnerable to a server-side template injection due to inadequate validation of user-controlled message fields before rendering templates. This vulnerability could be exploited by authenticated attackers with a standard operational role, enabling them to inject template expressions capable of reading, modifying, or deleting arbitrary data in the database, as well as executing outbound requests or sending emails from the server. The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the affected systems.

References