CVE-2026-72911

Received Received - Intake

Server-Side Template Injection in ERPNext

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72911

Affected Vendors & Products

Vendor	Product	Version / Range
erpnext	erpnext	to 15.118.0 (exc)
erpnext	erpnext	to 16.29.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This vulnerability in ERPNext versions before 15.118.0 and 16.29.0 allows an authenticated user with basic operational access to inject malicious template expressions into the system. The issue occurs in the process_statement_of_accounts module where unrestricted global variables like frappe.utils are rendered without proper validation. This enables arbitrary server-side code execution and unauthorized data access across the application.

Detection Guidance

Check ERPNext version with: bench version. If version is below 15.118.0 or 16.29.0, the system is vulnerable. Review logs for template injection attempts in accounts/doctype/process_statement_of_accounts.py.

Impact Analysis

An attacker could exploit this to execute malicious code on the server, potentially stealing sensitive data, modifying records, or disrupting business operations. Since it requires only common operational role access, the attack surface is significant for organizations using vulnerable ERPNext versions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected ERPNext versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade ERPNext to version 15.118.0 or 16.29.0 immediately. Restrict user roles to least privilege. Monitor for unauthorized code execution or data access.

Hi! I’m here to help you understand CVE-2026-72911. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70