CVE-2025-66436: Code Injection
An SSTI (Server-Side Template Injection) vulnerability exists in the gettermsandconditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.rendertemplate() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via getsafeglobals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66436?
The severity of CVE-2025-66436 is classified as high due to its potential for remote code execution through server-side template injection.
How do I fix CVE-2025-66436?
To fix CVE-2025-66436, upgrade Frappe ERPNext to version 15.89.1 or later where the vulnerability has been addressed.
What types of attacks are possible with CVE-2025-66436?
CVE-2025-66436 allows attackers to execute arbitrary code on the server by injecting malicious Jinja2 templates.
Which versions of Frappe ERPNext are affected by CVE-2025-66436?
Frappe ERPNext versions up to and including 15.89.0 are affected by CVE-2025-66436.
Is CVE-2025-66436 present in all configurations of Frappe ERPNext?
Yes, CVE-2025-66436 exists in all configurations of Frappe ERPNext using the vulnerable get_terms_and_conditions method.