CVE-2026-38431

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI)

Critical · published May 5, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00603 · 48.2th percentile
Published
2026-05-05T00:00Z
EPSS history
Timeline
  • 05 MAY 00:00Z
    ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI)
    cvelistv5