CVE-2026-109633: Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
ERPNext instances that expose a public-facing booking page and have privileged users review submitted booking content are exposed to the attack path described.
What does an attacker need to exploit this issue?
The attacker does not need authentication and can submit crafted content through the public booking page. Exploitation also requires a privileged user to render the stored content in their browser.
How can I determine whether my instance needs remediation?
Instances running ERPNext versions earlier than 15.119.1 in the 15.x line, or earlier than 16.32.0 in the 16.x line, are affected according to the advisory. Confirm whether the instance also makes the booking page publicly reachable.
What is the impact after successful exploitation?
Script executes in the privileged user's session and can act with that user's permissions. The advisory states this can enable takeover of the privileged user's account.