CVE-2026-109612 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a classic Stored Cross-Site Scripting (XSS) vulnerability within the Frappe ERPNext framework, specifically affecting versions prior to 15.120.0 and version 16.x prior to 16.33.0. This vulnerability stems from an insufficient sanitization of user-supplied input during the rendering process for report views. When a record is created or updated within the application, its name field is directly interpolated into HTML markup without proper encoding or escaping mechanisms in place. Consequently, if an attacker crafts a malicious payload and stores it as part of a legitimate-looking record name, this script remains persistent on the server side until manually removed by an administrator.
The operational impact of this vulnerability is significant due to its stored nature combined with the broad accessibility of report views within ERP systems. Any authenticated user who possesses the privilege to create records can inject the malicious payload into the database. Subsequently, any other authorized user who accesses a report containing that specific record will have their browser execute the injected script in the context of the application session. This allows for Session Hijacking, where an attacker can steal authentication cookies or tokens to impersonate legitimate users. It also enables Phishing attacks by allowing the injection of fake login forms or deceptive UI elements designed to harvest credentials from unsuspecting employees who trust the ERPNext interface.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. The specific mechanism involves server-side template injection where dynamic content is rendered without adequate context-aware escaping. In terms of adversary tactics and techniques, this flaw facilitates the Initial Access and Collection phases within the MITRE ATT&CK framework. Attackers can leverage this vector to establish a foothold in the network by compromising user accounts through credential theft or session hijacking, thereby gaining deeper access to sensitive business data managed by the ERP system.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade Frappe ERPNext to version 15.120.0 or later, which includes patches for this specific input validation issue. For environments where upgrading is not immediately feasible, administrators should implement strict Input Validation rules that reject special characters in record names used in report contexts. Additionally, deploying a Web Application Firewall with robust XSS detection capabilities can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. Developers must also ensure that all future implementations utilize context-appropriate output encoding to prevent similar vulnerabilities from arising during data rendering processes.