Frappe ERPNext server-side template injection in message fields lets authenticated users read and write data (CVE-2026-109652)

What happened

ERPNext does not validate user-controlled message fields before they are passed to the template engine. An attacker who can authenticate with a common operational role, and who can supply or influence those fields, can inject server-side template expressions. The expressions run in an unrestricted context, so the attacker can read and write arbitrary database data, delete documents, cause the server to make outbound requests, and send mail from the site.

The CVSS 4.0 score is 8.7, High: the attack vector is the network, attack complexity is low, the attacker needs only low privileges and no user interaction, and there is high impact to the confidentiality, integrity and availability of the ERPNext system. There is no indication in the advisory sources that this has been exploited in the wild.

Who is affected

ERPNext releases before 15.119.1 are affected. The 16.x line is affected from 16.0.0-beta.1 through versions before 16.32.0. This is the ERPNext product, and the weakness is reachable by an authenticated user with a common operational role.

What to do now

1. Check whether your deployment is ERPNext 15.x below 15.119.1 or 16.x below 16.32.0.
2. Upgrade to ERPNext 15.119.1 if you are on the 15.x line, or ERPNext 16.32.0 if you are on the 16.x line. These are the fixed releases.
3. No workaround is described in the advisory. Until you can update, reduce which accounts can use affected message fields or templates, and monitor for the behaviours listed below.
4. After updating, review logs for unexpected database changes, outbound requests from the ERPNext server, or unusual mail activity.

How to detect it

The advisory does not publish vendor-defined indicators of compromise. Based on the capabilities described, monitor for unexpected outbound HTTP or other requests from the ERPNext server, unusual mail sent by the site, and document modifications or deletions performed by low-privilege accounts.

Beyond the patch

This flaw is a patch-cycle problem as much as a code flaw: a low-privilege account in ERPNext can become broad database and mail access until fixed versions are deployed. Supply Chain Defense & Third-Party Risk helps you track which vendors' software you run and how quickly fixes appear. If your ERPNext instance is internet-exposed or public-facing, Implementation & Assessment Services can test whether it and its message-field handling are reachable before and after an upgrade.