Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-17T21:16:46.887Z",
  "pubdate": "2026-08-17T21:16:46.887Z",
  "executiveSummary": "An arbitrary code execution vulnerability exists within ERPNext prior to versions 15.111.0 and 16.22.0. The vulnerability stems from an insufficient permission boundary enforcement in the Frappe safe execution mechanism, specifically through the exposure of the frappe.render_template function without forcing the restrict_globals parameter.\nThis security flaw allows limited authenticated users to bypass intended application controls and achieve Server-Side Template Injection (SSTI). Successful exploitation grants an attacker the capability to execute arbitrary system commands and arbitrary code on the underlying host operating system.\nThe risk implication is critical, as it compromises the complete confidentiality, integrity, and availability of the affected ERPNext deployment. Exploitation requires limited authentication to access the vulnerable execution context, after which the attacker can leverage the exposed templating functionality to execute malicious payloads.\nOrganizations utilizing vulnerable versions of ERPNext face severe exposure to remote compromise. Immediate remediation is required to eliminate the underlying template injection vector.",
  "technicalDetails": "The vulnerability is rooted in the Frappe safe execution component of ERPNext, specifically affecting versions prior to 15.111.0 and 16.22.0. The core architectural defect involves the exposure of the frappe.render_template function to limited authenticated users without enforcing the restrict_globals parameter.\nIn template engines and execution contexts, failing to restrict global variables exposes sensitive underlying Python objects and built-in functions. By invoking frappe.render_template without proper context sandboxing, an attacker is able to construct and inject malicious template payloads that interact with restricted modules and execution scopes.\nThe attack flow proceeds as follows: First, the adversary authenticates to the ERPNext application with limited user privileges. Second, the attacker interacts with the exposed functional interface that invokes frappe.render_template. Third, by supplying a crafted input string containing template syntax designed to traverse the global object space, the attacker achieves Server-Side Template Injection (SSTI).\nOnce the template is evaluated by the server, the lack of restriction on global variables allows the payload to break out of the intended application sandbox. This enables the execution of arbitrary Python code within the context of the running application process.\nThe post-exploitation impact includes full Remote Code Execution (RCE), allowing the adversary to read or write arbitrary files on the filesystem, pivot deeper into the internal network, extract sensitive database contents, or execute system commands with the privileges of the web application server."
}