CVE-2026-38431 describes a Server-Side Template Injection vulnerability in ERPNext v15.103.1 and earlier. The vulnerability arises because email templates can contain expressions that are evaluated on the server side. An attacker with the ability to create or modify email templates can inject malicious expressions that execute during template rendering, potentially compromising the server environment. There is no published CVSS score or vendor advisory detailing remediation or patch availability at this time.

An attacker with email template creation or editing privileges can execute arbitrary code on the server by injecting malicious template expressions. This could lead to unauthorized access, data exposure, or further compromise of the ERPNext system. The exact impact depends on the privileges of the attacker and the server environment. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to create or edit email templates to trusted users only to reduce the risk of exploitation.