SB2026081375 - Multiple vulnerabilities in ERPNext

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081375

SB2026081375 - Multiple vulnerabilities in ERPNext

Published: August 13, 2026 Updated: November 9, 2026

Security Bulletin ID SB2026081375
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: CVE-2026-109652)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in a template engine in user-controlled message fields when processing user-supplied message content. A remote user can inject crafted template expressions to execute arbitrary code.

Exploitation gives access to an unrestricted template context, which can enable arbitrary database reads and writes, document deletion, outbound requests from the server, and mail sent by the site.


2) SQL injection (CVE-ID: CVE-2026-109609)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in ERPNext endpoints when handling specially crafted requests. A remote user can send specially crafted requests to disclose sensitive information.


3) Missing Authorization (CVE-ID: CVE-2026-109610)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify data beyond their permitted role.

The vulnerability exists due to missing authorization in certain ERPNext endpoints when handling requests. A remote user can access these endpoints to modify data beyond their permitted role.


4) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker with low privileges to extract sensitive information from ERPNext through SQL injection.

The vulnerability exists due to missing validation of request input in affected ERPNext endpoints when they process specially crafted requests. A remote attacker with low privileges can send these requests over the network to manipulate database queries and retrieve sensitive information without victim interaction.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute script in a privileged user's session and act as that user.

The vulnerability exists due to missing neutralization of content submitted through ERPNext's public-facing booking page before it is stored and later rendered as raw HTML. An unauthenticated remote attacker can submit malicious booking content that executes when a privileged user views it, enabling account takeover.


Remediation

Install update from vendor's website.

References