High · published December 15, 2025
🚨 An authenticated user can exploit an SSTI flaw that sneaks through the Print Format rendering! This vulnerability could leak sensitive database information — and it’s mind-blowingly simple to pull off! 🔥 Think of this like a sneaky chef who can add hidden ingredients to recipes in a restaurant. If the chef has permission to change the menu, they can slip in extra spices (or malicious code) that end up serving up confidential secret sauce to anyone who orders the dish! An attacker who can create or modify a Print Format can inject Jinja expressions that lead to disastrous information disclosure from the database. This could potentially expose critical details like database version, schema information, or sensitive values that your organization has worked hard to protect. This vulnerability could lay bare the blueprints of your entire database!
Think of this like a sneaky chef who can add hidden ingredients to recipes in a restaurant. If the chef has permission to change the menu, they can slip in extra spices (or malicious code) that end up serving up confidential secret sauce to anyone who orders the dish! This Server-Side Template Injection vulnerability in Frappe ERPNext (up to version 15.89.0) allows authenticated users with Print Format privileges to inject arbitrary Jinja expressions through the rendering mechanism. Despite being sandboxed, functions like frappe.db.sql can still be accessed through get_safe_globals(), opening the door to unauthorized data exposure.
An attacker who can create or modify a Print Format can inject Jinja expressions that lead to disastrous information disclosure from the database. This could potentially expose critical details like database version, schema information, or sensitive values that your organization has worked hard to protect. This vulnerability could lay bare the blueprints of your entire database! Immediately patch your Frappe ERPNext installation to the latest version where this vulnerability has been addressed. Additionally, review user permissions and restrict access to Print Format creation and modification functionality. Regular audits can help ensure that only authorized users have these capabilities. 🛡️ You've got this! Follow these steps, and you’ll have your defenses back up and running in no time! 🦸♂️✨
| Product | Versions | Fixed in |
|---|---|---|
| frappe/erpnext | ≤ 15.89.0 | — |