Advisory · CVE-2026-109652
Server-side template injection in ERPNext message fields
ERPNext before 15.119.1 and 16.x before 16.32.0 does not validate user-controlled message fields before template rendering, letting an authenticated attacker run expressions that read and write arbitrary database data. CVSS 3.1 8.8.
- Vendor
- Frappe
- Product
- ERPNext
- Identifier / CWE
- CVE-2026-109652
CWE-1336 - Action timing
- Immediate
Explain it like I’m five
ERPNext renders message text as a template without checking it first, so a user can hide live instructions inside a message and the server obeys them.
- 01Operational role
An authenticated attacker holding a common operational role edits a message field.
- 02Template expression
The field contains a template expression that ERPNext does not validate before rendering.
- 03Server-side execution
The expression runs in an unrestricted context, reading and writing database data, deleting documents, and triggering outbound requests or mail.
What happened
The Frappe project disclosed CVE-2026-109652 for ERPNext before 15.119.1 and 16.x before 16.32.0. User-controlled message fields are not validated before template rendering (CWE-1336), allowing expressions to run in an unrestricted context. Per the disclosure, an attacker can read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.
Per the vendor’s affected data, upgrade to 15.119.1 or 16.32.0 or later for the respective lines.
What to do
- Inventory every ERPNext deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to ERPNext while remediation is underway, especially for internet-facing instances.
- Review application and server logs for message fields containing template syntax, unexpected outbound requests or mail from the ERPNext server, and deleted documents.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Template injection is server-side code execution in a business suit. Upgrade, then search stored messages for template syntax before you trust the data.