CVE-2026-44445: ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44445?
CVE-2026-44445 is considered to have a high severity due to its potential for unauthorized access to sensitive information.
How do I fix CVE-2026-44445?
To fix CVE-2026-44445, upgrade the ERPNext software to versions 15.104.3 or 16.12.0 or later.
Who is affected by CVE-2026-44445?
CVE-2026-44445 affects users of the ERPNext EDI Module prior to versions 15.104.3 and 16.12.0.
What type of vulnerability is CVE-2026-44445?
CVE-2026-44445 is an XML External Entity (XEE) reference vulnerability.
Can I exploit CVE-2026-44445 remotely?
Yes, CVE-2026-44445 can be exploited remotely if the attacker has authenticated access to the EDI Module.