CVE-2026-96672 in ERPNext
Summary
by MITRE • 09/23/2026
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Frappe ERPNext versions prior to 16.34.1 represents a critical insecure deserialization and remote code execution risk stemming from insufficient input validation within the Financial Report Template functionality. This flaw allows authenticated users with specific privileges, such as Accounts Managers, to manipulate server-side behavior by injecting arbitrary Python method references into calculation formulas. The core technical issue lies in how the application processes user-supplied data for financial reporting calculations. When a user defines or modifies a report template, they can specify a calculation_formula that is intended to trigger backend logic. However, the system fails to rigorously validate whether this formula points exclusively to whitelisted methods before passing it to the frappe.call() function. This lack of strict allowlisting creates an avenue for attackers to bypass security controls and execute arbitrary code on the server with the privileges of the web application process.
From a technical perspective, the vulnerability exploits the dynamic nature of Python's method invocation capabilities within the Frappe framework. By supplying dotted Python paths that reference internal or non-whitelisted methods, an attacker can effectively invoke functions that were not intended for public access through the API layer. This mechanism bypasses standard authentication and authorization checks typically enforced by whitelisting decorators in the Frappe ecosystem. The ability to read return values from these arbitrary methods significantly escalates the impact beyond simple code execution, enabling data exfiltration of sensitive financial records, configuration details, or other proprietary information stored within the ERPNext database. This aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), and specifically relates to CWE-78, where improper neutralization of special elements used in an OS command is mirrored here by the injection of arbitrary code paths into a server-side execution context.
The operational impact of this vulnerability is severe for organizations relying on ERPNext for financial management. An attacker with Accounts Manager privileges can compromise the integrity and confidentiality of the entire system. They may extract sensitive payroll data, customer payment information, or internal audit logs by invoking methods that return such details. Furthermore, if the executed method allows for write operations or interacts with external systems, it could lead to further lateral movement within the network or complete system takeover. This vulnerability undermines the trust model of multi-tenant ERP deployments where role-based access control is expected to isolate sensitive financial data from lower-level administrative roles. The ability to read return values transforms this into a significant information disclosure vector, potentially violating regulatory compliance requirements such as GDPR or SOX depending on the jurisdiction and industry sector.
To mitigate this risk, organizations running Frappe ERPNext must immediately upgrade to version 16.34.1 or later, where the validation logic for calculation_formula inputs has been strengthened to ensure only whitelisted methods are permitted. Until patching is complete, administrators should restrict Accounts Manager privileges to trusted individuals and monitor server logs for unusual patterns of method invocations involving financial report templates. Implementing a Web Application Firewall with rules that detect attempts to inject Python-style dotted paths into form fields can provide an additional layer of defense in depth. Additionally, reviewing the ATT&CK framework reveals parallels to T1059 Command and Scripting Interpreter, where attackers use system utilities or scripting languages to execute commands, highlighting the importance of strict input validation and least-privilege access controls in enterprise software architectures.