CVE-2026-38431

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2026-05-05

Last modified

2026-05-06

Weaknesses

CWE-94

Affected products

• Erpnext (Frappe)

References

• https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine