Threat Intelligence Database

ERPNext versions up to v15.103.1 are affected by a Server-Side Template Injection (SSTI) vulnerability. This flaw allows an attacker with permissions to create or edit email templates to inject malicious template expressions that execute on the server during template rendering. The vulnerability has a critical severity rating with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the address_dict parameter, which can be either a dictionary or a string referencing an Address document. Although ERPNext uses a custom Jinja2 SandboxedEnvironment, dangerous functions like frappe.db.sql remain accessible via get_safe_globals(). An authenticated attacker with permission to create or modify an Address Template can inject arbitrary Jinja expressions into the template field. By creating an Address document with a matching country, and then calling the get_address_display API with address_dict="address_name", the system will render the malicious template using attacker-controlled data. This leads to server-side code execution or database information disclosure.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-66437