Frappe ERPNext: Server-side template injection via message fields
Summary
Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0 do not validate user-controlled message fields before template rendering. An authenticated user with a common operational role can inject template expressions that run in an unrestricted context. This allows reading and writing arbitrary database data, deleting documents, sending outbound requests from the server, and sending mail from the site.
Affected
- ERPNext before 15.119.1
- ERPNext 16.0.0-beta.1 to before 16.32.0
Fixed in
- 15.119.1
- 16.32.0
- Check the official release list for newer 16.x builds.
Workaround
- No workaround available according to the vendor. Upgrading is required.
- A third-party web application firewall rule is not vendor-confirmed and must not be relied on as a fix.
Exploitation
- Known exploitation: none found in the consulted sources. CISA SSVC assessment: exploitation none.
- Public proof of concept: none found, which is not confirmation that none exists.
- CISA KEV status was not verified directly.
Our recommendation
- Upgrade all ERPNext installations to 15.119.1 or 16.32.0 (or a later release) with high priority.
- Until patched, restrict which users hold operational roles that can submit messages.
- Review logs for unusual template syntax in message submissions.
- Check whether the instance is reachable from the internet and verify mail and outbound-request settings.
- Note the severity discrepancy: vendor rates it Critical (CVSS 3.1 9.9), CVSS 4.0 score is 8.7. Use the vendor severity for prioritisation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6w83-8777-v93q github.com
- VulnCheck advisory: Frappe ERPNext before 15.119.1 www.vulncheck.com
- OSV: CVE-2026-109652 osv.dev
- VulDB: CVE-2026-109652 vuldb.com
- Strix: CVE-2026-109652 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:40.
Original description (NVD)
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.