CVE-2026-109662: Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
ERPNext versions before 15.112.0 and 16.x versions before 16.23.0 are affected when the vulnerable public portal form is available to accept unauthenticated submissions.
What does an attacker need to exploit this issue?
An attacker does not need an account or privileges. They need to submit crafted markup through the public portal form and rely on a staff member later viewing the stored record in a browser.
Are staff browser sessions at risk?
Yes. The crafted content executes in the browser session of staff who review the submitted record, with potential impact to confidentiality and integrity in that session.
How can I determine whether exploitation may have occurred?
Review records submitted through the affected public portal form for crafted or unexpected markup, particularly records that staff have opened or reviewed. The provided information does not identify specific indicators of compromise beyond malicious stored content.