← Vulnerability feed

Vulnerability record · CVE-2026-72911 · published 10 August 2026

CVE-2026-72911: ERPNext is a free and open source Enterprise Resource Planning tool.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

9.9 CVSS 3.1 Critical EPSS 0.72% · top 48.1% CWE-1336 · CWE-1336 Deferred
9.9CVSS 3.1 base score
0.72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
7References
9 Sep 2026Last modified by NVD

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

LinkTags
https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28
https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39
https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465
https://github.com/frappe/erpnext/pull/56458
https://github.com/frappe/erpnext/releases/tag/v15.118.0
https://github.com/frappe/erpnext/releases/tag/v16.29.0
https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7

Track CVE-2026-72911 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-75650Adobe Commerce template engine flaw allows unauthenticated remote code executionAdobe Commerce, Commerce B2B and Magento are affected by improper neutralization of special elements used in a template engine (CWE-1336), allowing a…KEVEPSS 3.9%analysed9.8CVE-2024-23692Rejetto HTTP File Server template injection leads to unauthenticated RCERejetto HTTP File Server through version 2.3m is vulnerable to template injection, allowing a remote unauthenticated attacker to execute arbitrary co…KEVEPSS 99%analysed10.0CVE-2024-4040CrushFTP server-side template injection enables unauthenticated sandbox escape and RCECrushFTP versions before 10.7.1 and 11.1.0 contain a server-side template injection flaw that lets unauthenticated remote attackers escape the VFS sa…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2026-72911), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.