CVE-2026-109671: Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 15.113.0 - Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.24.0
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe ERPNext versions before 15.113.0 are affected, as are 16.x versions before 16.24.0. The issue is in portal pages that render the vulnerable profile field without escaping it.
What access does an attacker need to exploit this issue?
An attacker needs a low-privilege ERPNext account that can store content in the affected profile field. Exploitation also requires an administrator to view a portal page where that stored field is rendered.
What is the likely impact if exploitation succeeds?
The stored script executes in the administrator's browser and can enable administrator account takeover. The reported impact includes high confidentiality and integrity impact, with no availability impact indicated.
How can teams determine whether they may already be exposed?
Identify ERPNext instances running versions earlier than 15.113.0 or 16.x earlier than 16.24.0, and review whether low-privilege users can populate the profile field displayed on portal pages. Investigate stored values in that field for script or other unexpected markup.