CVE-2025-66434: Code Injection
An SSTI (Server-Side Template Injection) vulnerability exists in the getdunninglettertext method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (bodytext) using frappe.rendertemplate() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via getsafeglobals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66434?
The severity of CVE-2025-66434 is considered high due to its ability to allow remote code execution via Server-Side Template Injection.
How do I fix CVE-2025-66434?
To fix CVE-2025-66434, update Frappe ERPNext to a version higher than 15.89.0 where the vulnerability is patched.
What is the impact of CVE-2025-66434?
The impact of CVE-2025-66434 includes unauthorized access and the potential for attackers to execute arbitrary code on the server.
Which versions of Frappe ERPNext are affected by CVE-2025-66434?
Versions of Frappe ERPNext up to and including 15.89.0 are affected by CVE-2025-66434.
What kind of attack can exploit CVE-2025-66434?
CVE-2025-66434 can be exploited through Server-Side Template Injection (SSTI), allowing attackers to render and execute arbitrary Jinja2 templates.