CVE-2026-109652 Overview
CVE-2026-109652 is a server-side template injection (SSTI) vulnerability in Frappe ERPNext affecting versions before 15.119.1 and 16.x before 16.32.0. User-controlled message fields reach the template renderer without validation, letting expressions execute in an unrestricted context. Authenticated attackers who hold a common operational role can inject template expressions to read and write arbitrary database records, delete documents, send outbound HTTP requests from the server, and send mail from the site. The flaw is tracked under CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine.
Critical Impact
Authenticated users with low-privilege operational roles can execute template expressions server-side, enabling data theft, data destruction, and outbound request abuse from the ERPNext host.
Affected Products
- Frappe ERPNext versions prior to 15.119.1
- Frappe ERPNext 16.x versions prior to 16.32.0
- Deployments exposing message fields to authenticated operational roles
Discovery Timeline
- 2026-10-12 - CVE-2026-109652 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-109652
Vulnerability Analysis
ERPNext renders user-supplied message fields through its Jinja-based template engine without sanitizing or sandboxing the input. Because the rendering context is unrestricted, injected expressions gain access to the application's Python objects, including the Frappe ORM and HTTP client utilities. An authenticated user with a common operational role can submit a message containing template directives, and the server will evaluate those directives during normal document processing.
Successful exploitation allows arbitrary database reads and writes, document deletion, outbound requests originating from the server, and mail delivery under the trusted site identity. These primitives support credential harvesting, lateral movement, and data exfiltration from internal systems reachable by the ERPNext host.
Root Cause
The root cause is missing input validation on message fields prior to template rendering, combined with the use of an unrestricted template evaluation context [CWE-1336]. The template engine exposes application internals that should not be reachable from user-controlled strings.
Attack Vector
Exploitation requires network access to the ERPNext web interface and valid credentials for an account carrying a routine operational role. The attacker places template expressions inside a message field on a supported document type. When the server renders the field, the expressions execute with the privileges of the ERPNext worker process. No user interaction from an administrator is required.
Refer to the GitHub Security Advisory GHSA-6w83-8777-v93q and the VulnCheck Advisory on ERPNext Injection for additional technical detail.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-109652
Indicators of Compromise
- Message, subject, or comment fields containing Jinja delimiters such as {{, }}, {%, or %} submitted by non-administrative accounts.
- Unexpected outbound HTTP connections from the ERPNext application server to attacker-controlled hosts.
- Unusual mail sent from the site identity, particularly to external recipients outside normal business workflows.
- Database rows modified or deleted by low-privilege accounts outside their functional scope.
Detection Strategies
- Inspect ERPNext application and audit logs for template syntax inside user-submitted document fields.
- Alert on document create or update events authored by non-admin roles that correlate with new outbound socket activity from the ERPNext host.
- Hunt for Frappe background job executions that invoke requests, urllib, or frappe.sendmail immediately after a document save event.
Monitoring Recommendations
- Enable verbose audit logging for Frappe document events and forward logs to a centralized analytics platform for retention and correlation.
- Monitor egress traffic from ERPNext servers and baseline expected destinations to flag anomalous callbacks.
- Track mail queue activity for spikes in outbound messages or deliveries to unfamiliar domains.
How to Mitigate CVE-2026-109652
Immediate Actions Required
- Upgrade ERPNext to version 15.119.1 or 16.32.0 or later without delay.
- Audit which roles can create or edit documents containing message fields, and remove unnecessary assignments.
- Review recent document history and mail logs for signs of template injection attempts since the vulnerable versions were deployed.
- Rotate API keys, SMTP credentials, and database secrets accessible to the ERPNext application if compromise is suspected.
Patch Information
The Frappe maintainers resolved CVE-2026-109652 in ERPNext 15.119.1 and 16.32.0. The fixes add validation of user-controlled message fields and constrain the template rendering context. Patch metadata and release notes are available in the GitHub Security Advisory GHSA-6w83-8777-v93q.
Workarounds
- Restrict assignment of operational roles that can submit message fields on affected document types until patches are applied.
- Place the ERPNext instance behind a web application firewall rule that blocks requests containing Jinja template delimiters in message parameters.
- Apply strict egress filtering on the ERPNext server to prevent outbound requests to untrusted destinations.
# Upgrade ERPNext using the bench CLI
bench update --reset
bench --site <your-site> migrate
bench version
# Confirm erpnext >= 15.119.1 or >= 16.32.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
