CVE-2026-44445 is an improper restriction of XML external entity references vulnerability (CWE-611) in the ERPNext EDI Module. It affects versions prior to 15.104.3 and 16.12.0. An authenticated attacker can exploit this vulnerability to read arbitrary files from the local file system, potentially exposing sensitive configuration data. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. The issue is resolved in ERPNext versions 15.104.3 and 16.12.0.

An authenticated attacker can read files from the local file system, including sensitive configuration files, which may lead to information disclosure. There is no indication of remote code execution or privilege escalation. No known active exploitation has been reported.

Upgrade ERPNext to version 15.104.3 or later, or 16.12.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in these versions, applying these updates fully mitigates the risk. No additional mitigations are specified or required.