Frappe ERPNext: Stored cross-site scripting via public booking page
Summary
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 stores content submitted through a public-facing booking page without neutralization. An unauthenticated attacker can submit crafted content that is rendered as raw HTML in a privileged user's session, where it executes script. This can lead to the attacker acting as that user and taking over the account. The attack requires that a privileged user views the malicious entry.
Affected
- Frappe ERPNext before 15.119.1
- Frappe ERPNext 16.0.0-beta.1 up to before 16.32.0
Fixed in
- Upgrade to ERPNext 15.119.1 or later
- Upgrade to ERPNext 16.32.0 or later
Workaround
No vendor workaround available. Upgrading is required.
- Interim option (not from vendor): temporarily disable or restrict the public booking page.
- Interim option (not from vendor): review stored booking submissions for script or HTML content.
Exploitation
- Known exploited: no, according to the sources reviewed; CISA KEV not checked directly.
- Public proof of concept: none found; absence of evidence is not proof that none exists.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
Our recommendation
- Check whether ERPNext 15 or 16 is in use and whether the booking page is reachable from the internet.
- Update to ERPNext 15.119.1 or 16.32.0 as soon as possible.
- Until the update is applied, restrict or disable the public booking page.
- Review stored booking submissions for script or HTML content and check privileged accounts for unexpected activity.
- Verify the version ranges against the GitHub advisory, as the advisory text could not be retrieved in full.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rv4r-c8v3-3hrc github.com
- VulnCheck Advisory: Frappe ERPNext Stored XSS via Public Booking Page www.vulncheck.com
- OSV: CVE-2026-109633 osv.dev
- Threatint CVE record CVE-2026-109633 cve.threatint.com
- HOL Guard: CVE-2026-109633 hol.org
- Strix: CVE-2026-109633 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:37.
Original description (NVD)
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.