CVE-2026-38431

Critical

Published: 05/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

ERPNext v15.103.1 and earlier is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.

Risk Assessment

This vulnerability could lead to unauthorized code execution on the server, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update ERPNext to the latest version and restrict user permissions for editing email templates to trusted individuals.

Original NVD description (English source)

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.