CVE-2025-66435: Code Injection
An SSTI (Server-Side Template Injection) vulnerability exists in the getcontracttemplate method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contractterms) using frappe.rendertemplate() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via getsafeglobals(). An authenticated attacker with access to create or modify a Contract Template can inject arbitrary Jinja expressions into the contractterms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66435?
CVE-2025-66435 has a high severity due to its potential to allow remote code execution through Server-Side Template Injection.
How do I fix CVE-2025-66435?
To fix CVE-2025-66435, upgrade to a version of Frappe ERPNext that is higher than 15.89.0 where the vulnerability has been patched.
Who is affected by CVE-2025-66435?
CVE-2025-66435 affects users of Frappe ERPNext up to version 15.89.0 who utilize the get_contract_template method.
What does CVE-2025-66435 exploit?
CVE-2025-66435 exploits the ability to render attacker-controlled Jinja2 templates due to improper handling of user-supplied context.
Is there a workaround for CVE-2025-66435?
There are no formal workarounds for CVE-2025-66435; the recommended course of action is to upgrade to the latest version.