Files or Directories Accessible to External Parties in ERPNext - #VU163032
Published: November 9, 2026
Vulnerability identifier: #VU163032
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-552
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read imported supplier e-invoices containing sensitive financial information.
The vulnerability exists due to ERPNext's Regional module storing supplier electronic invoice files as publicly accessible files when importing invoices for Italy. An unauthenticated remote attacker can derive an invoice's public URL from the supplier's VAT number and invoice sequence and retrieve its contents without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.124.0, 16.52.0