Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T21:17:25.993Z",
  "pubdate": "2026-08-10T21:17:25.993Z",
  "executiveSummary": "An arbitrary server-side code execution vulnerability exists within the ERPNext Enterprise Resource Planning tool prior to versions 15.118.0 and 16.29.0.\nThe flaw manifests via insecure template rendering mechanics in the process statement of accounts module.\nAn authenticated user possessing a common operational role can supply crafted template expressions to the subject, body, and pdf_name fields.\nSuccessful exploitation allows attackers to bypass security boundaries, execute arbitrary server-side code, and read sensitive data across the entire application.\nThis vulnerability compromises the confidentiality, integrity, and availability of the underlying server infrastructure and hosted data.\nExploitation requires authentication with specific operational privileges within the application context.",
  "technicalDetails": "The vulnerability resides in the vulnerable component located at erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py.\nThe root cause stems from the insecure implementation of the validate_template and render_template functions.\nThese functions process the subject, body, and pdf_name fields with unrestricted globals, which explicitly include sensitive objects such as frappe.utils.\nBecause the execution context fails to sandbox or restrict available global variables and built-in functions, template injection becomes viable.\nAn authenticated attacker with a common operational role initiates the attack flow by supplying malicious template syntax payloads into the affected input vectors.\nWhen the application evaluates and renders the template strings, the underlying template engine interprets the injected expressions within the unrestricted global scope.\nThis behavior facilitates Remote Code Execution (RCE) by leveraging exposed framework utilities and Python execution pathways accessible via the template context.\nFurthermore, the unrestricted access model enables cross-tenant or unauthorized data reading across the application storage layer.\nAffected versions comprise all ERPNext installations prior to version 15.118.0 in the v15 branch and version 16.29.0 in the v16 branch.\nPost-exploitation impact includes full system compromise, data exfiltration, and potential lateral movement within the network infrastructure housing the ERPNext deployment."
}