CVE-2026-38431
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).
Published May 5, 2026 · updated Jul 24, 2026 · frappe erpnext
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 5, 2026 · NIST NVD
Detected
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.
Jul 24, 2026 · NIST NVD
Updated
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.
Affected
- cpe frappe/erpnextversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-38431
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-38431
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.
nvd.nist.gov