Frappe ERPNext: Stored cross-site scripting via profile field in portal pages
Summary
Frappe ERPNext renders a profile field on portal pages without escaping. A low-privilege user can store malicious script in this field, which runs in the browser of any administrator who views those pages. The advisory states that this is sufficient to take over the administrator's account and thereby the ERP system. User interaction by the administrator is required.
Affected
- Frappe ERPNext before 15.113.0
- Frappe ERPNext 16.0.0-beta.1 to before 16.24.0
Fixed in
- Update to ERPNext 15.113.0 or later (15.x)
- Update to ERPNext 16.24.0 or later (16.x)
Workaround
- No workaround available according to the vendor advisory; upgrading is required.
- Until the upgrade is done, limit or disable self-registration for portal users and review existing portal accounts (own suggestion, not from the vendor).
- Ask administrators not to open portal-facing records while logged into the back office (own suggestion, not from the vendor).
Exploitation
- CISA SSVC: exploitation none, not automatable.
- No public proof-of-concept found at the time of research.
- No evidence of known exploitation in the sources reviewed; the CISA KEV catalogue was not checked directly.
Our recommendation
- Check the installed ERPNext version now and upgrade to 15.113.0 or 16.24.0 (or later) if affected.
- Review portal user accounts and self-registration settings, and check whether the portal is reachable from the internet.
- Review administrator accounts for unexpected changes if the portal was used by untrusted users before patching.
- Check the GitHub advisory and the CISA KEV catalogue before closing the ticket.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rg9g-c26v-cw27 github.com
- VulnCheck Advisory: Frappe ERPNext Stored XSS via Profile Field www.vulncheck.com
- OSV record CVE-2026-109671 osv.dev
- Positive Technologies PT-2026-111084 (Vulners) vulners.com
- HOL Guard CVE record CVE-2026-109671 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:47.
Original description (NVD)
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.