CVE-2026-72908: ERPNext: Possibility of SQL injection due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 15.109.0 - Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 16.20.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72908?
The severity of CVE-2026-72908 is rated medium with a score of 6.5.
How do I fix CVE-2026-72908?
To fix CVE-2026-72908, update ERPNext to versions 15.109.0 or later, or 16.20.0 or later.
What type of vulnerability is CVE-2026-72908?
CVE-2026-72908 is classified as a SQL injection vulnerability.
Who is affected by CVE-2026-72908?
Authenticated low-privileged users in ERPNext are affected by CVE-2026-72908.
What is the potential impact of CVE-2026-72908?
CVE-2026-72908 can allow an attacker to manipulate database queries, potentially leading to unauthorized access to sensitive information.