CVE-2026-109652

Summary

A server-side template injection vulnerability in Frappe ERPNext allows authenticated attackers to execute arbitrary template expressions that can read, write, and delete database records, send outbound requests, and send emails. This flaw enables attackers to manipulate the application's template rendering engine without proper input validation.

Exploitability

The vulnerability is relatively easy to exploit as it requires only an authenticated user with a common operational role; attackers can inject template expressions directly into message fields to execute arbitrary code in an unrestricted context.

Blast radius

If exploited, this vulnerability could lead to full database access and manipulation, unauthorized outbound communications, and email spoofing across the ERPNext platform, affecting multiple business processes and data integrity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ERPNext version 15.119.1 or 16.32.0 to remediate this template injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.