CVE-2026-109671 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe ERPNext framework, specifically affecting versions prior to 15.113.0 and version 16.x prior to 16.24.0. This vulnerability is classified as a stored cross-site scripting issue located in a user profile field that is rendered on portal pages without proper output encoding or escaping mechanisms. The core technical deficiency lies in the application's failure to sanitize user-supplied input before it is persisted and subsequently displayed within the context of an HTML document. When a user submits data containing malicious JavaScript payloads into this specific profile field, the server accepts and stores this content as part of the user's persistent profile information without validating or neutralizing script tags or event handlers.
The operational impact of this vulnerability is severe due to its stored nature combined with the high privilege level of the target audience. Unlike reflected cross-site scripting where an attacker must trick a victim into clicking a malicious link, this flaw allows low-privilege attackers to implant persistent code directly into the application's database or storage layer. Any administrator who views the affected portal page containing the compromised profile data will have their browser execute the injected script automatically. This execution occurs within the security context of the authenticated administrative session, granting the attacker full access to the capabilities available to that administrator account. Consequently, this can lead to complete system compromise, including unauthorized modification or deletion of critical business data, exfiltration of sensitive information such as customer records and financial transactions, and potentially using the compromised server for further attacks against internal network resources.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored input that is later rendered in a different context without proper encoding. In terms of the MITRE ATT&CK framework, this attack vector corresponds to T1059 Command and Control Execution via Browser or Client-Side Rendering techniques often utilized for session hijacking and privilege escalation within web applications. The attacker leverages the trusted relationship between the administrator's browser and the ERPNext portal to bypass authentication controls effectively.
To mitigate this vulnerability, organizations must immediately upgrade their Frappe ERPNext instances to version 15.113.0 or later if running on the v15 branch, or version 16.24.0 or later for those on the v16 branch. These releases contain patches that implement proper input validation and output encoding strategies. Developers should ensure that all dynamic content rendered in HTML contexts is passed through robust escaping functions specific to the rendering context, such as HTML entity encoding for text nodes or attribute value encoding where appropriate. Additionally implementing a Content Security Policy can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact even if similar vulnerabilities exist in other parts of the application infrastructure. Regular security audits and static code analysis focused on input handling practices are recommended to prevent recurrence of such issues across the entire software suite.