Threats affecting pkg:pypi/frappe

CVE-2026-124443 is a broken access control vulnerability in the Frappe Framework versions before 15.121.1 and 16.x before 16.35.0. It allows authenticated users to query file lists or report views and obtain metadata of private files they are not authorized to access.

CVE-2026-119145 is a critical path traversal vulnerability in Frappe versions before 15.121.0 and 16.x before 16.34.0. The flaw allows authenticated attackers to upload crafted files to arbitrary locations outside the intended storage directory, potentially leading to remote code execution on the server. This occurs because the file-upload handling does not properly validate destination paths before writing files to disk. The vulnerability has a CVSS 4.0 score of 9.4, indicating high severity. Fixed versions are 15.121.0 and 16.34.0.

CVE-2026-119144 is a server-side template injection vulnerability in the Frappe Framework affecting versions before 15.111.0 and 16.x before 16.21.0. It arises because user-controlled message fields are rendered as templates without proper neutralization, allowing an authenticated attacker with common operational privileges to inject and execute arbitrary template expressions on the server.

Frappe Framework versions before 16.33.0 contain a blind SQL injection vulnerability in the get_events method of the frappe.desk.doctype.event.event module. This flaw allows authenticated attackers to send crafted input that is not properly neutralized before being included in SQL queries, enabling them to infer database information from application behavior.

An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the address_dict parameter, which can be either a dictionary or a string referencing an Address document. Although ERPNext uses a custom Jinja2 SandboxedEnvironment, dangerous functions like frappe.db.sql remain accessible via get_safe_globals(). An authenticated attacker with permission to create or modify an Address Template can inject arbitrary Jinja expressions into the template field. By creating an Address document with a matching country, and then calling the get_address_display API with address_dict="address_name", the system will render the malicious template using attacker-controlled data. This leads to server-side code execution or database information disclosure.

An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.

An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contract_terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Contract Template can inject arbitrary Jinja expressions into the contract_terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.