CVE-2026-65974: ERPNext: Server-Side Template Injection leading to Remote Code Execution
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNext (Frappe)to a version that resolves this vulnerability.Fixed in 15.111.0 - Upgrade
Upgrade
ERPNext (Frappe)to a version that resolves this vulnerability.Fixed in 16.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65974?
CVE-2026-65974 has a critical severity rating of 9.9.
What type of vulnerability is CVE-2026-65974?
CVE-2026-65974 is a Server-Side Template Injection vulnerability that can lead to Remote Code Execution.
How do I fix CVE-2026-65974?
To fix CVE-2026-65974, upgrade to ERPNext version 15.111.0 or 16.22.0 or later.
Who is affected by CVE-2026-65974?
Limited authenticated users of ERPNext prior to version 15.111.0 and 16.22.0 are affected by CVE-2026-65974.
What causes the vulnerability CVE-2026-65974?
CVE-2026-65974 is caused by the exposure of frappe.render_template without enforcing restrict_globals, allowing unauthorized access.