SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2025-66437

HighCVSS 8.8
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.60%

47th percentile - higher than 47% of all known CVEs

Summary

An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the address_dict parameter, which can be either a dictionary or a string referencing an Address document. Although ERPNext uses a custom Jinja2 SandboxedEnvironment, dangerous functions like frappe.db.sql remain accessible via get_safe_globals(). An authenticated attacker with permission to create or modify an Address Template can inject arbitrary Jinja expressions into the template field. By creating an Address document with a matching country, and then calling the get_address_display API with address_dict="address_name", the system will render the malicious template using attacker-controlled data. This leads to server-side code execution or database information disclosure.

Risk Assessment

An attacker could execute arbitrary code in the context of the ERPNext server, potentially leading to full system compromise and access to sensitive data. However, it requires authentication and appropriate permissions.

Recommendation

Upgrade Frappe ERPNext to a version later than 15.89.0 that includes the fix. Restrict permissions for creating and modifying address templates and monitor for unusual activity.

Other vulnerabilities in Frappe ERPNext

See all
Original NVD description (English source)

An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the address_dict parameter, which can be either a dictionary or a string referencing an Address document. Although ERPNext uses a custom Jinja2 SandboxedEnvironment, dangerous functions like frappe.db.sql remain accessible via get_safe_globals(). An authenticated attacker with permission to create or modify an Address Template can inject arbitrary Jinja expressions into the template field. By creating an Address document with a matching country, and then calling the get_address_display API with address_dict="address_name", the system will render the malicious template using attacker-controlled data. This leads to server-side code execution or database information disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS