CVE-2026-55242CWE-1336CWE-863broken-access-control

CVE-2026-55242

High · published July 15, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00197 · 8.9th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-863 · Incorrect Authorization
Published
2026-07-15T20:16Z
References (1)
https://github.com/frappe/erpnext/security/advisories/GHSA-pxf3-4gvc-v45j · [email protected]
EPSS history
Timeline
  • 15 JUL 15:38Z
    ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
    cvelistv5