CVE-2026-38431 - Vulnerability Analysis

Overview

ERPNext <= 15.103.1 contains a server-side template injection caused by insufficient sanitization of email templates, letting attackers with template edit permissions execute arbitrary code on the server, exploit requires permission to create or edit email templates.

Severity & Score

Impact

Attackers with template edit permissions can execute arbitrary code on the server, potentially leading to full system compromise.

Mitigation

Update to the latest version beyond 15.103.1.

References

• https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner