CVE-2026-55242highCWE-1336CWE-863

CVE-2026-55242: fallo de gravedad alta en frappe erpnext

ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

Publicada el

Seguir esta CVE+ Monitorear erpnext

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.2%
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
frappe · erpnext
CVEs relacionadas — frappe erpnext

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-65974CRITICALERPNext: Server-Side Template Injection leading to Remote Code ExecutionEPSS 1.0%CVE-2026-72911CRITICALERPNext: Possibility of server-side template injection due to missing validationEPSS 0.7%CVE-2026-72908MEDIUMERPNext: Possibility of SQL injection due to missing validationEPSS 0.5%CVE-2026-72910HIGHERPNext: Unauthorised modification of master data due to missing validationEPSS 0.5%CVE-2026-72909HIGHERPNext: Broken Access Control on certain endpointsEPSS 0.5%CVE-2026-65822HIGHERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterEPSS 0.5%