CVE-2026-38431

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine	Exploit Third Party Advisory
https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-05 17:17

Updated : 2026-07-24 21:10

NVD link : CVE-2026-38431

Mitre link : CVE-2026-38431

CVE.ORG link : CVE-2026-38431

JSON object : View

Products Affected

frappe

erpnext

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-38431", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-38431", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T13:50:41.504498Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-05T17:17:04.670", "references": [{"url": "https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered."}, {"lang": "es", "value": "ERPNext v15.103.1 y anteriores es vulnerable a la Inyecci\u00f3n de Plantillas del Lado del Servidor (SSTI). Un atacante con permiso para crear o editar plantillas de correo electr\u00f3nico puede inyectar expresiones de plantilla que se ejecutan en el servidor cuando la plantilla es renderizada."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1300B107-AF39-4DBD-86BA-406B38A0FB1C", "versionEndIncluding": "15.103.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}