CVE-2026-72911 frappe CVE debrief

Who should care

ERPNext administrators and users, particularly those with common operational roles, should assess exposure and apply patches to prevent exploitation. The vulnerability affects versions prior to 15.118.0 and 16.29.0. ERPNext administrators and users should review and restrict access to sensitive areas of the ERPNext application and monitor for suspicious activity.

Why it matters

CVE-2026-72911 is a critical vulnerability in ERPNext that allows authenticated users to execute arbitrary server-side code, potentially leading to data breaches and application compromise. ERPNext administrators and users, particularly those with common operational roles, should assess exposure and apply patches to prevent exploitation. The vulnerability has a CVSS score of 9.9 and affects versions prior to 15.118.0 and 16.29.0.

• Authenticated users with common operational roles can inject template expressions and execute arbitrary server-side code
• Arbitrary server-side code execution can lead to data breaches and application compromise
• Read data across the application, potentially exposing sensitive information
• Verification of affected versions and patch application is crucial to prevent exploitation

Technical summary

The validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. The issue is fixed in versions 15.118.0 and 16.29.0. ERPNext administrators and users, particularly those with common operational roles, should assess exposure and apply patches to prevent exploitation.

Defensive priority

High priority for ERPNext administrators and users to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the ERPNext instance is running a version prior to 15.118.0 or 16.29.0
• Apply patches by upgrading to ERPNext version 15.118.0 or 16.29.0
• Review and restrict access to sensitive areas of the ERPNext application
• Monitor for suspicious activity and implement additional security measures as needed
• Verify the integrity of the ERPNext application and its components
• Conduct regular security audits to identify potential vulnerabilities
• Implement a change management process to ensure timely application of security patches

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.9 and the affected versions of ERPNext. The vulnerability allows authenticated users with common operational roles to inject template expressions and execute arbitrary server-side code. The issue is fixed in versions 15.118.0 and 16.29.0. ERPNext administrators and users should assess exposure and apply patches to prevent exploitation. The vulnerability affects versions prior to 15.118.0 and 16.29.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.