CVE-2026-72908 in ERPNext
Summary
by MITRE • 08/11/2026
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in ERPNext affects versions prior to 15.109.0 and 16.20.0, specifically within the get_tax_template function located in erpnext/accounts/doctype/tax_rule/tax_rule.py. This flaw represents a classic SQL injection vulnerability that arises from improper input validation and sanitization of user-supplied data. The function constructs SQL WHERE clauses dynamically using posting_date values and args parameters sourced directly from HTTP request data without adequate protection mechanisms.
The technical implementation of this vulnerability stems from the insecure construction of database queries where untrusted input flows directly into SQL execution contexts. When an authenticated user with low privilege level invokes the tax rule functionality, they can manipulate the posting_date and args parameters to inject malicious SQL fragments into the generated WHERE clause. This occurs because the application fails to employ parameterized queries or proper input sanitization techniques before incorporating user data into database operations.
The operational impact of this vulnerability extends beyond simple data extraction to potentially enable full database compromise when combined with other attack vectors. An attacker could leverage this weakness to access sensitive financial information, customer data, transaction records, and other confidential business data stored within the ERPNext system. The low privilege requirement means that even users with minimal access rights can exploit this flaw, making it particularly dangerous for organizations where internal threat mitigation is insufficient.
This vulnerability maps directly to CWE-89 SQL Injection, which is classified as a critical weakness in software security. The ATT&CK framework categorizes this as an exploitation of application vulnerabilities under the technique T1213 Data from Information Repositories, potentially leading to credential theft and lateral movement within the network. Organizations using ERPNext versions before the fixed releases face significant risk of unauthorized data access and potential system compromise.
Mitigation strategies should focus on implementing proper input validation and parameterized query construction throughout the application codebase. The fix implemented in versions 15.109.0 and 16.20.0 demonstrates the importance of sanitizing all user inputs before database integration and adopting prepared statements for SQL operations. Organizations should immediately upgrade to patched versions, implement additional monitoring for suspicious API calls, and conduct thorough code reviews to identify similar injection vulnerabilities in other components of their ERP systems.