CVE-2026-109652

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.1 Frappe ERPNext versions 16.x prior to 16.32.0

Description Server-side template injection occurs because user-controlled message fields are not validated before template rendering, which allows expressions to run in an unrestricted context. Authenticated attackers with a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

Recommendations Update to version 15.119.1 or later. Update to version 16.32.0 or later.