CVE-2026-55242highCWE-1336CWE-863

CVE-2026-55242: falha de alta gravidade em frappe erpnext

ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

Publicada em

Seguir esta CVE+ Monitorar erpnext

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.2%
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
frappe · erpnext
CVEs relacionadas — frappe erpnext

No mesmo produto, das mais perigosas para as menos.

CVE-2026-65974CRITICALERPNext: Server-Side Template Injection leading to Remote Code ExecutionEPSS 1.0%CVE-2026-72911CRITICALERPNext: Possibility of server-side template injection due to missing validationEPSS 0.7%CVE-2026-72908MEDIUMERPNext: Possibility of SQL injection due to missing validationEPSS 0.5%CVE-2026-72910HIGHERPNext: Unauthorised modification of master data due to missing validationEPSS 0.5%CVE-2026-72909HIGHERPNext: Broken Access Control on certain endpointsEPSS 0.5%CVE-2026-65822HIGHERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterEPSS 0.5%