Frappe Erpnext vulnerabilities

CVE-2025-28062 [HIGH] CWE-352 CVE-2025-28062: A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.

CVE-2026-65974 [CRITICAL] CWE-1336 CVE-2026-65974: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed i

CVE-2026-72911 [CRITICAL] CWE-1336 CVE-2026-72911: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authen

CVE-2025-66434 [HIGH] CWE-94 CVE-2025-66434: An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such

CVE-2026-44442 [CRITICAL] CWE-862 CVE-2026-44442: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoi ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

CVE-2023-54345 [HIGH] CWE-94 CVE-2023-54345: Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that all Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke

CVE-2022-28598 [MEDIUM] CWE-79 CVE-2022-28598: Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly ne Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2018-11339 [MEDIUM] CWE-79 CVE-2018-11339: An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.

CVE-2025-66437 [HIGH] CWE-94 CVE-2025-66437: An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of F An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the address_dict parameter, which can be either a dictionary or a string referencing an Address document. Although ERPNext u

CVE-2025-66440 [HIGH] CWE-89 CVE-2025-66440: An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_docume An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the to_posting_date parameter, which is directly interpolated

CVE-2025-66439 [HIGH] CWE-89 CVE-2025-66439: An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_docume An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the from_posting_date parameter, which is directly interpolat

CVE-2026-31017 [CRITICAL] CWE-918 CVE-2026-31017: A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNe A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application allows the inclusion of HTML elements such as that

CVE-2026-38431 [CRITICAL] CWE-94 CVE-2026-38431: ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker wit ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.

CVE-2026-27471 [CRITICAL] CWE-284 CVE-2026-27471: ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0. ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

CVE-2025-66438 [HIGH] CWE-94 CVE-2025-66438: A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 P A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chai

CVE-2025-67289 [CRITICAL] CWE-79 CVE-2025-67289: An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

CVE-2020-6145 [HIGH] CWE-89 CVE-2020-6145: An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11. An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVE-2025-58439 [CRITICAL] CWE-89 CVE-2025-58439: ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0. ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions 14.89.2 and 15.76.0.

CVE-2026-32954 [HIGH] CWE-89 CVE-2026-32954: ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15. ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.

CVE-2018-3884 [HIGH] CWE-89 CVE-2018-3884: An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Spec An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sort_by and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are requi