CVE-2026-109633

Deferred Deferred - Pending Action

Stored XSS in Frappe ERPNext

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109633

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0. Attackers can submit malicious content via a public booking page that gets stored without proper sanitization. When a privileged user views this content, it executes as raw HTML in their session, allowing the attacker to impersonate the user and potentially take over their account.

Detection Guidance

To detect this vulnerability, inspect public-facing booking pages in Frappe ERPNext for improperly sanitized user input. Look for raw HTML or script tags in stored content. Check server logs for unusual POST requests to booking endpoints. No specific commands are provided in the context.

Impact Analysis

Unauthenticated attackers could exploit this to gain unauthorized access to privileged accounts, steal sensitive data, perform actions on behalf of legitimate users, or take full control of the system. This could lead to data breaches, financial loss, or disruption of services if the ERPNext instance handles critical business operations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (healthcare data) by enabling unauthorized access to personal or sensitive data. Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to inadequate security measures.

Mitigation Strategies

Upgrade Frappe ERPNext to version 15.119.1 or later if using 15.x, or to 16.32.0 or later if using 16.x. Apply input validation and output encoding to all public-facing forms. Review and sanitize existing stored content for malicious scripts.

Hi! I’m here to help you understand CVE-2026-109633. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70