CVE-2026-72911 in ERPNext
Summary
by MITRE • 08/11/2026
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in ERPNext affects versions prior to 15.118.0 and 16.29.0, specifically within the process_statement_of_accounts.py file where validate_template and render_template functions are implemented. This represents a critical server-side template injection flaw that enables authenticated users with common operational roles to execute arbitrary code on the server. The vulnerability stems from unrestricted globals inclusion in the template rendering process, particularly exposing frappe.utils and other sensitive modules to template evaluation contexts.
The technical implementation of this vulnerability allows an attacker to manipulate subject, body, and pdf_name fields through template expressions that are processed without proper sanitization or context isolation. When these fields contain malicious template syntax, the system evaluates them as part of the rendering pipeline, creating opportunities for code execution and data exfiltration. The flaw essentially permits attackers to bypass normal access controls and escalate privileges by executing server-side code with the permissions of the ERPNext application.
From an operational impact perspective, this vulnerability creates significant risk for organizations using ERPNext, as authenticated users can potentially access sensitive financial data, customer information, and other business-critical resources across the entire application. The attack surface extends beyond simple code execution to include potential data breaches, system compromise, and unauthorized modifications to business processes. This aligns with CWE-94, which describes improper control of generation of code, specifically template injection vulnerabilities that allow arbitrary code execution through template processing.
The exploitation of this vulnerability follows patterns consistent with ATT&CK technique T1059.006 for server-side code injection and T1566 for credential access through application vulnerabilities. Attackers could leverage this to establish persistent access, escalate privileges, or move laterally within the network where ERPNext is deployed. The common operational role requirement suggests that even users with standard business permissions could exploit this, making it particularly dangerous in environments where privilege separation is not strictly enforced.
Organizations should immediately upgrade to versions 15.118.0 or 16.29.0 to remediate this vulnerability, as these releases implement proper template sanitization and context isolation measures. Additional mitigations include implementing least-privilege access controls for users with template modification capabilities, conducting thorough code reviews of template processing functions, and monitoring for suspicious template usage patterns. The fix addresses the core issue by ensuring that template variables are properly sanitized and that global objects like frappe.utils are not directly accessible during template evaluation, thereby preventing the injection of malicious expressions that could lead to arbitrary code execution.