CVE-2026-109662 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext, specifically affecting versions prior to 15.112.0 and version 16.x prior to 16.23.0. This vulnerability is classified as a Stored Cross-Site Scripting issue, which represents one of the most persistent and dangerous categories of web application security risks. The core technical deficiency lies in the insufficient neutralization of user-supplied input within public portal forms that accept unauthenticated submissions. When an attacker submits data containing malicious script payloads through these forms, the system fails to properly sanitize or encode the special characters before storing them in the backend database. Consequently, when authorized staff members later access and review these stored records through their browser sessions, the embedded scripts are executed by the web server's rendering engine without prior validation. This mechanism allows arbitrary JavaScript code to run within the context of the victim’s session, effectively bypassing same-origin policy protections that typically isolate malicious content from legitimate application data.
From an operational perspective, this vulnerability poses a severe risk to organizational integrity and confidentiality because it leverages trusted administrative interfaces for exploitation. Since the form is public and unauthenticated, any individual on the internet can inject payloads without needing valid credentials or triggering complex authentication bypasses. The impact escalates significantly when internal staff members with elevated privileges view these records. An attacker could steal session cookies, hijack active sessions to impersonate legitimate users, perform actions as those users such as modifying financial data or exporting sensitive customer information, or even redirect the user’s browser to phishing sites designed to capture further credentials. The persistence of this attack vector means that a single successful injection can compromise multiple administrators over an extended period until the malicious content is manually removed from the database and the vulnerability is patched in subsequent software updates.
This incident aligns with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack methodology corresponds to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within a browser environment, and falls under the broader category of Client-Side Injection attacks found in tactic TA0004 Impact or TA0005 Defense Evasion depending on the specific payload intent such as credential harvesting versus data destruction. The exploitation chain typically involves initial access via unauthenticated web forms followed by persistence through stored malicious content that triggers execution upon subsequent legitimate user interaction, thereby establishing a foothold within the trusted network perimeter without direct external intrusion tools.
To mitigate this vulnerability and prevent similar occurrences in enterprise resource planning systems, immediate action is required to upgrade Frappe ERPNext to version 15.112.0 or later for the legacy branch, or version 16.23.0 or later for the current release line where these input validation controls have been strengthened. In addition to patching, organizations should implement strict output encoding strategies ensuring that all data rendered in HTML contexts is properly escaped according to OWASP guidelines. Input validation must be enforced at both the client and server sides using allow-lists rather than block-lists to reject unexpected character sequences before they reach storage layers. Furthermore, deploying Content Security Policy headers can significantly reduce the impact of any residual cross-site scripting vulnerabilities by restricting script execution sources and preventing inline script evaluation unless explicitly whitelisted for specific trusted domains. Regular security audits focusing on public-facing forms that store user-generated content are essential to maintain robust defense-in-depth posture against persistent web-based threats.