CVE-2026-44445 Overview
ERPNext is a free and open source Enterprise Resource Planning (ERP) tool maintained by Frappe. CVE-2026-44445 is an XML External Entity (XXE) vulnerability in the EDI Module that affects versions prior to 15.104.3 and 16.12.0. An authenticated attacker can abuse the XML parser to read arbitrary files from the local file system, including sensitive configuration files. The issue is tracked as CWE-611: Improper Restriction of XML External Entity Reference. Frappe has released fixed versions 15.104.3 and 16.12.0 to address the flaw.
Critical Impact
Authenticated attackers can read local files, including ERPNext configuration data, by submitting crafted XML payloads to the EDI Module.
Affected Products
- ERPNext versions prior to 15.104.3 (15.x branch)
- ERPNext versions prior to 16.12.0 (16.x branch)
- Deployments exposing the EDI Module to authenticated users
Discovery Timeline
- 2026-05-13 - CVE-2026-44445 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-44445
Vulnerability Analysis
The EDI Module in ERPNext parses XML input without disabling external entity resolution. When an authenticated user submits an XML document, the parser dereferences external entities defined in the document type definition (DTD). An attacker can declare an entity referencing a local file path and have its contents reflected into the parsed output or processing flow.
This behavior allows the attacker to exfiltrate files readable by the ERPNext service account. Sensitive targets include site_config.json, common_site_config.json, and credentials stored under the bench directory. The vulnerability requires authentication but no user interaction, and it can be triggered over the network through the standard ERPNext interface.
Root Cause
The root cause is an unsafe XML parser configuration in the EDI Module. External entity processing and DTD resolution remain enabled, which contradicts secure XML parsing guidance. CWE-611 describes this class of flaw, where untrusted XML input is processed without restricting external references.
Attack Vector
An authenticated attacker submits an XML payload to the EDI Module containing a malicious external entity declaration. The entity references a local file path such as file:///home/frappe/frappe-bench/sites/site_config.json. When the parser resolves the entity, the file contents are read into the XML processing context and returned or otherwise exposed to the attacker. See the GitHub Security Advisory GHSA-mhm9-75w7-423r for vendor details.
Detection Methods for CVE-2026-44445
Indicators of Compromise
- XML payloads submitted to EDI Module endpoints containing <!DOCTYPE declarations or <!ENTITY definitions
- Requests referencing SYSTEM identifiers with file://, http://, or ftp:// schemes inside XML bodies
- Outbound connections from the ERPNext application server to unexpected hosts during XML processing
- Unexpected reads of files such as site_config.json, /etc/passwd, or files under frappe-bench/sites/ by the ERPNext process
Detection Strategies
- Inspect web application logs for POST requests to EDI Module endpoints carrying XML content types and DOCTYPE markers
- Apply web application firewall (WAF) rules that flag XML payloads containing external entity declarations
- Correlate authenticated session activity with file access events on the ERPNext host to identify anomalous reads
Monitoring Recommendations
- Forward ERPNext application logs and Frappe bench logs to a centralized log platform for retention and search
- Alert on outbound DNS or HTTP traffic initiated by the ERPNext worker processes, which can indicate out-of-band XXE exfiltration
- Track usage of EDI Module endpoints and baseline normal user activity to surface low-and-slow abuse
How to Mitigate CVE-2026-44445
Immediate Actions Required
- Upgrade ERPNext to 15.104.3 or 16.12.0 or later as published in the vendor advisory
- Audit accounts with access to the EDI Module and remove unnecessary privileges
- Rotate credentials and API keys stored in site_config.json if exposure is suspected
- Review recent EDI Module activity for XML payloads containing entity declarations
Patch Information
Frappe released fixed builds in ERPNext 15.104.3 and 16.12.0. The patched releases harden XML parsing in the EDI Module to reject external entity references. Refer to the GitHub Security Advisory GHSA-mhm9-75w7-423r for upgrade instructions and commit references.
Workarounds
- Restrict access to the EDI Module to a minimum set of trusted users until patching is complete
- Block inbound XML payloads containing <!DOCTYPE or <!ENTITY declarations at a reverse proxy or WAF
- Restrict outbound network access from the ERPNext application server to prevent out-of-band data exfiltration
# Upgrade ERPNext using bench to a fixed release
bench switch-to-branch version-15 erpnext --upgrade
bench update --reset
bench --site all migrate
# Verify installed version meets 15.104.3 or 16.12.0 or later
bench version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
